Open Build Service

php7.spec Changed

@@ -53,8 +53,6 @@
 Source1:        php-suse-addons.tar.bz2
 Source5:        README.macros
 Source6:        macros.php
-Source8:        https://secure.php.net/distributions/php-%{version}.tar.xz.asc
-Source9:        php7.keyring
 Source11:       php7.rpmlintrc
 Source100:      build-test.sh
 ## SUSE specific patches
@@ -77,6 +75,9 @@
 # should be upstreamed, will do later
 Patch17:        php-date-regenerate-lexers.patch
 Patch1000:      session-save-path.patch
+# CVE-2026-109618 CVE-2026-109619 (PHP2Shell), community backport for remicollet/php-src-security
+# https://github.com/Anton-Barinov/php2shell-patches php-7.3-enhanced-remicollet.patch
+Patch1001:      php7-CVE-2026-109618,109619.patch
 BuildRequires:  apache-rpm-macros
 BuildRequires:  apache2-devel
 BuildRequires:  autoconf
@@ -1059,6 +1060,7 @@
 %patch12 -p1
 %patch17 -p1
 %patch1000 -p1
+%patch1001 -p1
 
 # Safety check for API version change.
 vapi=`sed -n '/#define PHP_API_VERSION/{s/.* //;p}' main/php.h`
@@ -1103,7 +1105,6 @@
 rm -r ext/pcre/pcre2lib
 
 # regenerate configure etc.
-rm configure
 ./buildconf --force
 
 # export flags

php-7.3.33.tar.xz.asc Deleted

php-7.3.33.tar.xz/NEWS Changed

@@ -1,5 +1,166 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+
+Backported from 8.2.33
+
+- GD:
+  . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)
+
+- PGSQL:
+  . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
+    (CVE-2026-17543) (ilutov)
+
+- Phar:
+  . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
+    (Jakub Zelenka)
+
+Backported from 8.2.32
+
+- OpenSSL:
+  . Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in
+    openssl_encrypt with AES-WRAP-PAD). (David Carlier)
+
+Backported from 8.2.31
+
+- FPM:
+  . Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735)
+    (Jakub Zelenka)
+
+- SOAP:
+  . Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache
+    Map). (CVE-2026-6722) (ilutov)
+  . Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with
+    SOAP_PERSISTENCE_SESSION). (CVE-2026-7261) (ilutov)
+  . Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check).
+    (CVE-2026-7262) (ilutov)
+
+- Standard:
+  . Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset).
+    (CVE-2026-7568) (TimWolla)
+
+Backported from 8.1.34
+
+  . Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()).
+    (CVE-2025-14178) (ndossche)
+
+Backported from 8.1.31
+
+- CLI:
+  . Fixed bug GHSA-4w77-75f9-2c8w (Heap-Use-After-Free in sapi_read_post_data
+    Processing in CLI SAPI Interface). (nielsdos)
+
+- LDAP:
+  . Fixed bug GHSA-g665-fm4p-vhff (OOB access in ldap_escape). (CVE-2024-8932)
+    (nielsdos)
+
+- MySQLnd:
+  . Fixed bug GHSA-h35g-vwh6-m678 (Leak partial content of the heap through
+    heap buffer over-read). (CVE-2024-8929) (Jakub Zelenka)
+
+- PDO DBLIB:
+  . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the dblib quoter causing
+    OOB writes). (CVE-2024-11236) (nielsdos)
+
+- PDO Firebird:
+  . Fixed bug GHSA-5hqh-c84r-qjcv (Integer overflow in the firebird quoter
+    causing OOB writes). (CVE-2024-11236) (nielsdos)
+
+- Streams:
+  . Fixed bug GHSA-c5f2-jwm7-mmq2 (Configuring a proxy in a stream context
+    might allow for CRLF injection in URIs). (CVE-2024-11234) (Jakub Zelenka)
+  . Fixed bug GHSA-r977-prxv-hc43 (Single byte overread with
+    convert.quoted-printable-decode filter). (CVE-2024-11233) (nielsdos)
+
+Backported from 8.1.30
+
+- CGI:
+  . Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection
+    Vulnerability). (CVE-2024-8926) (nielsdos)
+  . Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is
+    bypassable due to the environment variable collision). (CVE-2024-8927)
+    (nielsdos)
+
+- SAPI:
+  . Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data).
+    (CVE-2024-8925) (Arnaud)
+
+Backported from 8.1.29
+
+- CGI:
+  . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection
+    in PHP-CGI). (CVE-2024-4577) (nielsdos)
+
+- Filter:
+  . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL).
+    (CVE-2024-5458) (nielsdos)
+
+Backported from 8.1.28
+
+- Standard:
+  . Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to
+    partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
+  . Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true,
+    opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)
+
+Backported from 8.0.30
+
+- Libxml:
+  . Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading
+    in XML without enabling it). (CVE-2023-3823) (nielsdos, ilutov)
+
+- Phar:
+  . Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()).
+    (CVE-2023-3824) (nielsdos)
+
+Backported from 8.0.29
+
+- Soap:
+  . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
+    bytes in HTTP Digest authentication for SOAP).
+    (CVE-2023-3247) (nielsdos, timwolla)
+
+Backported from 8.0.28
+
+- Core:
+  . Fixed bug #81744 (Password_verify() always return true with some hash).
+    (CVE-2023-0567). (Tim Düsterhus)
+  . Fixed bug #81746 (1-byte array overrun in common path resolve code).
+    (CVE-2023-0568). (Niels Dossche)
+  . Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
+    request body). (CVE-2023-0662) (Jakub Zelenka)
+
+Backported from 8.0.27
+
+- PDO/SQLite:
+  . Fixed bug #81740 (PDO::quote() may return unquoted string).
+    (CVE-2022-31631) (cmb)
+
+Backported from 7.4.33
+
+- Hash:
+  . Fixed bug #81738: buffer overflow in hash_update() on long parameter.
+    (CVE-2022-37454) (nicky at mouha dot be)
+
+Backported from 7.4.32
+
+- Core:
+  . Fixed bug #81727: Don't mangle HTTP variable names that clash with ones
+    that have a specific semantic meaning. (CVE-2022-31629). (Derick)
+
+- Phar:
+  . Fixed bug #81726: phar wrapper: DOS when using quine gzip file.
+    (CVE-2022-31628). (cmb)
+
+Backported from 7.4.30
+
+- mysqlnd:
+  . Fixed bug #81719: mysqlnd/pdo password buffer overflow.
+    (CVE-2022-31626) (c dot fol at ambionics dot io)
+
+- pgsql
+  . Fixed bug #81720: Uninitialized array in pg_query_params().
+    (CVE-2022-31625) (cmb)
+
 18 Nov 2021, PHP 7.3.33
 
 - XML:

php-7.3.33.tar.xz/README.md Changed

@@ -1,39 +1,4 @@
-The PHP Interpreter
-===================
+This is a fork of the official PHP repository which receives backport of security fixes from maintained branches.
 
-This is the github mirror of the official PHP repository located at
-https://git.php.net.
+This branch is PHP version 7.3.33 with security fix.
 
-!Build Status(https://secure.travis-ci.org/php/php-src.svg?branch=master)(http://travis-ci.org/php/php-src)
-!Build status(https://ci.appveyor.com/api/projects/status/meyur6fviaxgdwdy?svg=true)(https://ci.appveyor.com/project/php/php-src)
-
-Pull Requests
-=============
-PHP accepts pull requests via github. Discussions are done on github, but
-depending on the topic can also be relayed to the official PHP developer
-mailing list internals@lists.php.net.
-
-New features require an RFC and must be accepted by the developers.
-See https://wiki.php.net/rfc and https://wiki.php.net/rfc/voting for more
-information on the process.
-
-Bug fixes **do not** require an RFC, but require a bugtracker ticket. Always
-open a ticket at https://bugs.php.net and reference the bug id using #NNNNNN.
-
-    Fix #55371: get_magic_quotes_gpc() throws deprecation warning
-
-    After removing magic quotes, the get_magic_quotes_gpc function caused
-    a deprecate warning. get_magic_quotes_gpc can be used to detected
-    the magic_quotes behavior and therefore should not raise a warning at any
-    time. The patch removes this warning
-
-We do not merge pull requests directly on github. All PRs will be
-pulled and pushed through https://git.php.net.
-
-
-Guidelines for contributors
-===========================
-- CODING_STANDARDS(/CODING_STANDARDS)
-- README.GIT-RULES(/README.GIT-RULES)
-- README.MAILINGLIST_RULES(/README.MAILINGLIST_RULES)
-- README.RELEASE_PROCESS(/README.RELEASE_PROCESS)

php-7.3.33.tar.xz/Zend/zend_string.h Changed

php-7.3.33.tar.xz/configure Deleted

@@ -1,108478 +0,0 @@
-#! /bin/sh
-# Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69.
-#
-#
-# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
-#
-#
-# This configure script is free software; the Free Software Foundation
-# gives unlimited permission to copy, distribute and modify it.
-## -------------------- ##
-## M4sh Initialization. ##
-## -------------------- ##
-
-# Be more Bourne compatible
-DUALCASE=1; export DUALCASE # for MKS sh
-if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then :
-  emulate sh
-  NULLCMD=:
-  # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which
-  # is contrary to our usage.  Disable this feature.
-  alias -g '${1+"$@"}'='"$@"'
-  setopt NO_GLOB_SUBST
-else
-  case `(set -o) 2>/dev/null` in #(
-  *posix*) :
-    set -o posix ;; #(
-  *) :
-     ;;
-esac
-fi
-
-
-as_nl='
-'
-export as_nl
-# Printing a long string crashes Solaris 7 /usr/bin/printf.
-as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\'
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo
-as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo
-# Prefer a ksh shell builtin over an external printf program on Solaris,
-# but without wasting forks for bash or zsh.
-if test -z "$BASH_VERSION$ZSH_VERSION" \
-    && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then
-  as_echo='print -r --'
-  as_echo_n='print -rn --'
-elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then
-  as_echo='printf %s\n'
-  as_echo_n='printf %s'
-else
-  if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then
-    as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"'
-    as_echo_n='/usr/ucb/echo -n'
-  else
-    as_echo_body='eval expr "X$1" : "X\$.*\$"'
-    as_echo_n_body='eval
-      arg=$1;
-      case $arg in #(
-      *"$as_nl"*)
-	expr "X$arg" : "X\$.*\$$as_nl";
-	arg=`expr "X$arg" : ".*$as_nl\$.*\$"`;;
-      esac;
-      expr "X$arg" : "X\$.*\$" | tr -d "$as_nl"
-    '
-    export as_echo_n_body
-    as_echo_n='sh -c $as_echo_n_body as_echo'
-  fi
-  export as_echo_body
-  as_echo='sh -c $as_echo_body as_echo'
-fi
-
-# The user is always right.
-if test "${PATH_SEPARATOR+set}" != set; then
-  PATH_SEPARATOR=:
-  (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && {
-    (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 ||
-      PATH_SEPARATOR=';'
-  }
-fi
-
-
-# IFS
-# We need space, tab and new line, in precisely that order.  Quoting is
-# there to prevent editors from complaining about space-tab.
-# (If _AS_PATH_WALK were called with IFS unset, it would disable word
-# splitting by setting IFS to empty value.)
-IFS=" ""	$as_nl"
-
-# Find who we are.  Look in the path if we contain no directory separator.
-as_myself=
-case $0 in #((
-  *\\/* ) as_myself=$0 ;;
-  *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break
-  done
-IFS=$as_save_IFS
-
-     ;;
-esac
-# We did not find ourselves, most probably we were run as `sh COMMAND'
-# in which case we are not to be found in the path.
-if test "x$as_myself" = x; then
-  as_myself=$0
-fi
-if test ! -f "$as_myself"; then
-  $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2
-  exit 1
-fi
-
-# Unset variables that we do not need and which cause bugs (e.g. in
-# pre-3.0 UWIN ksh).  But do not cause bugs in bash 2.01; the "|| exit 1"
-# suppresses any "Segmentation fault" message there.  '((' could
-# trigger a bug in pdksh 5.2.14.
-for as_var in BASH_ENV ENV MAIL MAILPATH
-do eval test x\${$as_var+set} = xset \
-  && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || :
-done
-PS1='$ '
-PS2='> '
-PS4='+ '
-
-# NLS nuisances.
-LC_ALL=C
-export LC_ALL
-LANGUAGE=C
-export LANGUAGE
-
-# CDPATH.
-(unset CDPATH) >/dev/null 2>&1 && unset CDPATH
-
-# Use a proper internal environment variable to ensure we don't fall
-  # into an infinite loop, continuously re-executing ourselves.
-  if test x"${_as_can_reexec}" != xno && test "x$CONFIG_SHELL" != x; then
-    _as_can_reexec=no; export _as_can_reexec;
-    # We cannot yet assume a decent shell, so we have to provide a
-# neutralization value for shells without unset; and this also
-# works around shells that cannot unset nonexistent variables.
-# Preserve -v and -x to the replacement shell.
-BASH_ENV=/dev/null
-ENV=/dev/null
-(unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV
-case $- in # ((((
-  *v*x* | *x*v* ) as_opts=-vx ;;
-  *v* ) as_opts=-v ;;
-  *x* ) as_opts=-x ;;
-  * ) as_opts= ;;
-esac
-exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"}
-# Admittedly, this is quite paranoid, since all the known shells bail
-# out after a failed `exec'.
-$as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2
-as_fn_exit 255
-  fi
-  # We don't want this to propagate to other subprocesses.
-          { _as_can_reexec=; unset _as_can_reexec;}
-if test "x$CONFIG_SHELL" = x; then
-  as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then :
-  emulate sh
-  NULLCMD=:
-  # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which
-  # is contrary to our usage.  Disable this feature.
-  alias -g '\${1+\"\$@\"}'='\"\$@\"'
-  setopt NO_GLOB_SUBST
-else
-  case \`(set -o) 2>/dev/null\` in #(
-  *posix*) :
-    set -o posix ;; #(
-  *) :
-     ;;
-esac
-fi
-"
-  as_required="as_fn_return () { (exit \$1); }
-as_fn_success () { as_fn_return 0; }
-as_fn_failure () { as_fn_return 1; }
-as_fn_ret_success () { return 0; }
-as_fn_ret_failure () { return 1; }
-
-exitcode=0
-as_fn_success || { exitcode=1; echo as_fn_success failed.; }
-as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; }
-as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; }
-as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; }
-if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then :
-
-else
-  exitcode=1; echo positional parameters were not saved.
-fi
-test x\$exitcode = x0 || exit 1
-test -x / || exit 1"
-  as_suggested="  as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO
-  as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO
-  eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" &&
-  test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1
-test \$(( 1 + 1 )) = 2 || exit 1"

php-7.3.33.tar.xz/ext/date/lib/parse_date.c Changed

@@ -1,4 +1,5 @@
 /* Generated by re2c 2.0.3 on Mon Aug 31 11:40:58 2020 */
+#line 1 "parse_date.re"
 /*
  * The MIT License (MIT)
  *
@@ -883,9 +884,11 @@
 std:
 	s->tok = cursor;
 	s->len = 0;
+#line 1011 "parse_date.re"
 
 
 
+#line 892 "<stdout>"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -1005,19 +1008,23 @@
 	YYDEBUG(2, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(3, *YYCURSOR);
+#line 1808 "parse_date.re"
 	{
 		s->pos = cursor; s->line++;
 		goto std;
 	}
+#line 1017 "<stdout>"
 yy4:
 	YYDEBUG(4, *YYCURSOR);
 	++YYCURSOR;
 yy5:
 	YYDEBUG(5, *YYCURSOR);
+#line 1814 "parse_date.re"
 	{
 		add_error(s, TIMELIB_ERR_UNEXPECTED_CHARACTER, "Unexpected character");
 		goto std;
 	}
+#line 1028 "<stdout>"
 yy6:
 	YYDEBUG(6, *YYCURSOR);
 	yyaccept = 0;
@@ -1029,9 +1036,11 @@
 	if (yych <= '9') goto yy57;
 yy7:
 	YYDEBUG(7, *YYCURSOR);
+#line 1803 "parse_date.re"
 	{
 		goto std;
 	}
+#line 1044 "<stdout>"
 yy8:
 	YYDEBUG(8, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -1568,6 +1577,7 @@
 	}
 yy18:
 	YYDEBUG(18, *YYCURSOR);
+#line 1719 "parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("tzcorrection | tz");
@@ -1580,6 +1590,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_TIMEZONE;
 	}
+#line 1594 "<stdout>"
 yy19:
 	YYDEBUG(19, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -3319,6 +3330,7 @@
 	}
 yy77:
 	YYDEBUG(77, *YYCURSOR);
+#line 1469 "parse_date.re"
 	{
 		DEBUG_OUTPUT("datenoyearrev");
 		TIMELIB_INIT;
@@ -3329,6 +3341,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
+#line 3345 "<stdout>"
 yy78:
 	YYDEBUG(78, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -3784,6 +3797,7 @@
 	if (yych == '.') goto yy275;
 yy107:
 	YYDEBUG(107, *YYCURSOR);
+#line 1071 "parse_date.re"
 	{
 		timelib_ull i;
 
@@ -3808,6 +3822,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
+#line 3826 "<stdout>"
 yy108:
 	YYDEBUG(108, *YYCURSOR);
 	++YYCURSOR;
@@ -6448,6 +6463,7 @@
 	}
 yy209:
 	YYDEBUG(209, *YYCURSOR);
+#line 1224 "parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("timeshort24 | timelong24 | iso8601long");
@@ -6472,6 +6488,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
+#line 6492 "<stdout>"
 yy210:
 	YYDEBUG(210, *YYCURSOR);
 	yyaccept = 5;
@@ -6534,6 +6551,7 @@
 	}
 yy214:
 	YYDEBUG(214, *YYCURSOR);
+#line 1316 "parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("americanshort | american");
@@ -6548,6 +6566,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_AMERICAN;
 	}
+#line 6570 "<stdout>"
 yy215:
 	YYDEBUG(215, *YYCURSOR);
 	yyaccept = 6;
@@ -6772,6 +6791,7 @@
 	if (yych <= '9') goto yy413;
 yy241:
 	YYDEBUG(241, *YYCURSOR);
+#line 1386 "parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datefull");
@@ -6785,6 +6805,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL;
 	}
+#line 6809 "<stdout>"
 yy242:
 	YYDEBUG(242, *YYCURSOR);
 	yyaccept = 3;
@@ -6898,6 +6919,7 @@
 	if (yych == 'e') goto yy422;
 yy250:
 	YYDEBUG(250, *YYCURSOR);
+#line 1787 "parse_date.re"
 	{
 		timelib_ull i;
 		DEBUG_OUTPUT("relative");
@@ -6912,6 +6934,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
+#line 6938 "<stdout>"
 yy251:
 	YYDEBUG(251, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -7212,6 +7235,7 @@
 	}
 yy278:
 	YYDEBUG(278, *YYCURSOR);
+#line 1629 "parse_date.re"
 	{
 		DEBUG_OUTPUT("ago");
 		TIMELIB_INIT;
@@ -7231,6 +7255,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_AGO;
 	}
+#line 7259 "<stdout>"
 yy279:
 	YYDEBUG(279, *YYCURSOR);
 	yyaccept = 8;
@@ -7269,6 +7294,7 @@
 	}
 yy280:
 	YYDEBUG(280, *YYCURSOR);
+#line 1709 "parse_date.re"
 	{
 		DEBUG_OUTPUT("monthtext");
 		TIMELIB_INIT;
@@ -7277,6 +7303,7 @@
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
+#line 7307 "<stdout>"
 yy281:
 	YYDEBUG(281, *YYCURSOR);
 	yyaccept = 8;
@@ -7851,6 +7878,7 @@
 	}

php-7.3.33.tar.xz/ext/dom/document.c Changed

@@ -1357,7 +1357,7 @@
 	int validate, recover, resolve_externals, keep_blanks, substitute_ent;
 	int resolved_path_len;
 	int old_error_reporting = 0;
-	char *directory=NULL, resolved_pathMAXPATHLEN;
+	char *directory=NULL, resolved_pathMAXPATHLEN + 1;
 
 	if (id != NULL) {
 		intern = Z_DOMOBJ_P(id);
@@ -1436,6 +1436,7 @@
 		options |= XML_PARSE_NOBLANKS;
 	}
 
+	php_libxml_sanitize_parse_ctxt_options(ctxt);
 	xmlCtxtUseOptions(ctxt, options);
 
 	ctxt->recovery = recover;
@@ -1733,7 +1734,9 @@
 
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);
 
+	PHP_LIBXML_SANITIZE_GLOBALS(xinclude);
 	err = xmlXIncludeProcessFlags(docp, (int)flags);
+	PHP_LIBXML_RESTORE_GLOBALS(xinclude);
 
 	/* XML_XINCLUDE_START and XML_XINCLUDE_END nodes need to be removed as these
 	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document
@@ -1772,6 +1775,7 @@
 
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);
 
+	PHP_LIBXML_SANITIZE_GLOBALS(validate);
 	cvp = xmlNewValidCtxt();
 
 	cvp->userData = NULL;
@@ -1783,6 +1787,7 @@
 	} else {
 		RETVAL_FALSE;
 	}
+	PHP_LIBXML_RESTORE_GLOBALS(validate);
 
 	xmlFreeValidCtxt(cvp);
 
@@ -1816,14 +1821,18 @@
 
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);
 
+	PHP_LIBXML_SANITIZE_GLOBALS(new_parser_ctxt);
+
 	switch (type) {
 	case DOM_LOAD_FILE:
 		if (CHECK_NULL_PATH(source, source_len)) {
+			PHP_LIBXML_RESTORE_GLOBALS(new_parser_ctxt);
 			php_error_docref(NULL, E_WARNING, "Invalid Schema file source");
 			RETURN_FALSE;
 		}
 		valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN);
 		if (!valid_file) {
+			PHP_LIBXML_RESTORE_GLOBALS(new_parser_ctxt);
 			php_error_docref(NULL, E_WARNING, "Invalid Schema file source");
 			RETURN_FALSE;
 		}
@@ -1844,6 +1853,7 @@
 		parser);
 	sptr = xmlSchemaParse(parser);
 	xmlSchemaFreeParserCtxt(parser);
+	PHP_LIBXML_RESTORE_GLOBALS(new_parser_ctxt);
 	if (!sptr) {
 		php_error_docref(NULL, E_WARNING, "Invalid Schema");
 		RETURN_FALSE;
@@ -1864,11 +1874,13 @@
 	}
 #endif
 
+	PHP_LIBXML_SANITIZE_GLOBALS(validate);
 	xmlSchemaSetValidOptions(vptr, valid_opts);
 	xmlSchemaSetValidErrors(vptr, php_libxml_error_handler, php_libxml_error_handler, vptr);
 	is_valid = xmlSchemaValidateDoc(vptr, docp);
 	xmlSchemaFree(sptr);
 	xmlSchemaFreeValidCtxt(vptr);
+	PHP_LIBXML_RESTORE_GLOBALS(validate);
 
 	if (is_valid == 0) {
 		RETURN_TRUE;
@@ -1938,12 +1950,14 @@
 		return;
 	}
 
+	PHP_LIBXML_SANITIZE_GLOBALS(parse);
 	xmlRelaxNGSetParserErrors(parser,
 		(xmlRelaxNGValidityErrorFunc) php_libxml_error_handler,
 		(xmlRelaxNGValidityWarningFunc) php_libxml_error_handler,
 		parser);
 	sptr = xmlRelaxNGParse(parser);
 	xmlRelaxNGFreeParserCtxt(parser);
+	PHP_LIBXML_RESTORE_GLOBALS(parse);
 	if (!sptr) {
 		php_error_docref(NULL, E_WARNING, "Invalid RelaxNG");
 		RETURN_FALSE;
@@ -2042,6 +2056,7 @@
 		ctxt->sax->error = php_libxml_ctx_error;
 		ctxt->sax->warning = php_libxml_ctx_warning;
 	}
+	php_libxml_sanitize_parse_ctxt_options(ctxt);
 	if (options) {
 		htmlCtxtUseOptions(ctxt, (int)options);
 	}

php-7.3.33.tar.xz/ext/dom/documentfragment.c Changed

php-7.3.33.tar.xz/ext/dom/tests/libxml_global_state_entity_loader_bypass.phpt Added

@@ -0,0 +1,37 @@
+--TEST--
+GHSA-3qrf-m4j2-pcrr (libxml global state entity loader bypass)
+--SKIPIF--
+<?php
+if (!extension_loaded('libxml')) die('skip libxml extension not available');
+if (!extension_loaded('dom')) die('skip dom extension not available');
+if (!extension_loaded('zend-test')) die('skip zend-test extension not available');
+if (!function_exists('zend_test_override_libxml_global_state')) die('skip not for Windows');
+?>
+--FILE--
+<?php
+
+$xml = "<?xml version='1.0'?><!DOCTYPE root <!ENTITY % bork SYSTEM \"php://nope\"> %bork;><nothing/>";
+
+libxml_use_internal_errors(true);
+
+function parseXML($xml) {
+  $doc = new DOMDocument();
+  @$doc->loadXML($xml);
+  $doc->createDocumentFragment()->appendXML("&bork;");
+  foreach (libxml_get_errors() as $error) {
+    var_dump(trim($error->message));
+  }
+}
+
+parseXML($xml);
+zend_test_override_libxml_global_state();
+parseXML($xml);
+
+echo "Done\n";
+
+?>
+--EXPECT--
+string(25) "Entity 'bork' not defined"
+string(25) "Entity 'bork' not defined"
+string(25) "Entity 'bork' not defined"
+Done

php-7.3.33.tar.xz/ext/filter/logical_filters.c Changed

@@ -79,7 +79,7 @@
 #define FORMAT_IPV4    4
 #define FORMAT_IPV6    6
 
-static int _php_filter_validate_ipv6(char *str, size_t str_len);
+static int _php_filter_validate_ipv6(const char *str, size_t str_len);
 
 static int php_filter_parse_int(const char *str, size_t str_len, zend_long *ret) { /* {{{ */
 	zend_long ctx_value;
@@ -548,6 +548,14 @@
 	return 1;
 }
 
+static zend_bool php_filter_is_valid_ipv6_hostname(const char *s, size_t l)
+{
+	const char *e = s + l;
+	const char *t = e - 1;
+
+	return *s == '' && *t == '' && _php_filter_validate_ipv6(s + 1, l - 2);
+}
+
 void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 {
 	php_url *url;
@@ -573,7 +581,7 @@
 
 	if (url->scheme != NULL &&
 		(zend_string_equals_literal_ci(url->scheme, "http") || zend_string_equals_literal_ci(url->scheme, "https"))) {
-		char *e, *s, *t;
+		const char *s;
 		size_t l;
 
 		if (url->host == NULL) {
@@ -582,17 +590,14 @@
 
 		s = ZSTR_VAL(url->host);
 		l = ZSTR_LEN(url->host);
-		e = s + l;
-		t = e - 1;
-
-		/* An IPv6 enclosed by square brackets is a valid hostname */
-		if (*s == '' && *t == '' && _php_filter_validate_ipv6((s + 1), l - 2)) {
-			php_url_free(url);
-			return;
-		}
 
-		// Validate domain
-		if (!_php_filter_validate_domain(ZSTR_VAL(url->host), l, FILTER_FLAG_HOSTNAME)) {
+		if (
+			/* An IPv6 enclosed by square brackets is a valid hostname.*/
+			!php_filter_is_valid_ipv6_hostname(s, l) &&
+			/* Validate domain.
+			 * This includes a loose check for an IPv4 address. */
+			!_php_filter_validate_domain(ZSTR_VAL(url->host), l, FILTER_FLAG_HOSTNAME)
+		) {
 			php_url_free(url);
 			RETURN_VALIDATION_FAILED
 		}
@@ -726,15 +731,15 @@
 }
 /* }}} */
 
-static int _php_filter_validate_ipv6(char *str, size_t str_len) /* {{{ */
+static int _php_filter_validate_ipv6(const char *str, size_t str_len) /* {{{ */
 {
 	int compressed = 0;
 	int blocks = 0;
 	int n;
 	char *ipv4;
-	char *end;
+	const char *end;
 	int ip4elm4;
-	char *s = str;
+	const char *s = str;
 
 	if (!memchr(str, ':', str_len)) {
 		return 0;

php-7.3.33.tar.xz/ext/filter/tests/ghsa-w8qr-v226-r27w.phpt Added

@@ -0,0 +1,41 @@
+--TEST--
+GHSA-w8qr-v226-r27w
+--EXTENSIONS--
+filter
+--FILE--
+<?php
+
+function test(string $input) {
+    var_dump(filter_var($input, FILTER_VALIDATE_URL));
+}
+
+echo "--- These ones should fail ---\n";
+test("http://test@127.0.0.1");
+test("http://test@::1");
+test("http://test@::1");
+test("http://test@::1");
+test("http://php.net\\@aliyun.com/aaa.do");
+test("http://test@2001:db8:3333:4444:5555:6666:1.2.3.4");
+test("http://test@2001:db8:3333:4444:5555:6666:1.2.3.4");
+test("http://test@2001:db8:3333:4444:5555:6666:1.2.3.4");
+
+echo "--- These ones should work ---\n";
+test("http://test@127.0.0.1");
+test("http://test@2001:db8:3333:4444:5555:6666:1.2.3.4");
+test("http://test@::1");
+
+?>
+--EXPECT--
+--- These ones should fail ---
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+--- These ones should work ---
+string(21) "http://test@127.0.0.1"
+string(50) "http://test@2001:db8:3333:4444:5555:6666:1.2.3.4"
+string(17) "http://test@::1"

php-7.3.33.tar.xz/ext/gd/libgd/gd_gif_in.c Changed

php-7.3.33.tar.xz/ext/hash/sha3/generic32lc/KeccakSponge.inc Changed

@@ -160,7 +160,7 @@
     i = 0;
     curData = data;
     while(i < dataByteLen) {
-        if ((instance->byteIOIndex == 0) && (dataByteLen >= (i + rateInBytes))) {
+        if ((instance->byteIOIndex == 0) && (dataByteLen-i >= rateInBytes)) {
 #ifdef SnP_FastLoop_Absorb
             /* processing full blocks first */
             if ((rateInBytes % (SnP_width/200)) == 0) {
@@ -186,9 +186,10 @@
         }
         else {
             /* normal lane: using the message queue */
-            partialBlock = (unsigned int)(dataByteLen - i);
-            if (partialBlock+instance->byteIOIndex > rateInBytes)
+            if (dataByteLen-i > rateInBytes-instance->byteIOIndex)
                 partialBlock = rateInBytes-instance->byteIOIndex;
+            else
+                partialBlock = (unsigned int)(dataByteLen - i);
             #ifdef KeccakReference
             displayBytes(1, "Block to be absorbed (part)", curData, partialBlock);
             #endif
@@ -263,7 +264,7 @@
     i = 0;
     curData = data;
     while(i < dataByteLen) {
-        if ((instance->byteIOIndex == rateInBytes) && (dataByteLen >= (i + rateInBytes))) {
+        if ((instance->byteIOIndex == rateInBytes) && (dataByteLen-i >= rateInBytes)) {
             for(j=dataByteLen-i; j>=rateInBytes; j-=rateInBytes) {
                 SnP_Permute(instance->state);
                 SnP_ExtractBytes(instance->state, curData, 0, rateInBytes);
@@ -280,9 +281,10 @@
                 SnP_Permute(instance->state);
                 instance->byteIOIndex = 0;
             }
-            partialBlock = (unsigned int)(dataByteLen - i);
-            if (partialBlock+instance->byteIOIndex > rateInBytes)
+            if (dataByteLen-i > rateInBytes-instance->byteIOIndex)
                 partialBlock = rateInBytes-instance->byteIOIndex;
+            else
+                partialBlock = (unsigned int)(dataByteLen - i);
             i += partialBlock;
 
             SnP_ExtractBytes(instance->state, curData, instance->byteIOIndex, partialBlock);

php-7.3.33.tar.xz/ext/hash/sha3/generic64lc/KeccakSponge.inc Changed

@@ -160,7 +160,7 @@
     i = 0;
     curData = data;
     while(i < dataByteLen) {
-        if ((instance->byteIOIndex == 0) && (dataByteLen >= (i + rateInBytes))) {
+        if ((instance->byteIOIndex == 0) && (dataByteLen-i >= rateInBytes)) {
 #ifdef SnP_FastLoop_Absorb
             /* processing full blocks first */
             if ((rateInBytes % (SnP_width/200)) == 0) {
@@ -186,9 +186,10 @@
         }
         else {
             /* normal lane: using the message queue */
-            partialBlock = (unsigned int)(dataByteLen - i);
-            if (partialBlock+instance->byteIOIndex > rateInBytes)
+            if (dataByteLen-i > rateInBytes-instance->byteIOIndex)
                 partialBlock = rateInBytes-instance->byteIOIndex;
+            else
+                partialBlock = (unsigned int)(dataByteLen - i);
             #ifdef KeccakReference
             displayBytes(1, "Block to be absorbed (part)", curData, partialBlock);
             #endif
@@ -263,7 +264,7 @@
     i = 0;
     curData = data;
     while(i < dataByteLen) {
-        if ((instance->byteIOIndex == rateInBytes) && (dataByteLen >= (i + rateInBytes))) {
+        if ((instance->byteIOIndex == rateInBytes) && (dataByteLen-i >= rateInBytes)) {
             for(j=dataByteLen-i; j>=rateInBytes; j-=rateInBytes) {
                 SnP_Permute(instance->state);
                 SnP_ExtractBytes(instance->state, curData, 0, rateInBytes);
@@ -280,9 +281,10 @@
                 SnP_Permute(instance->state);
                 instance->byteIOIndex = 0;
             }
-            partialBlock = (unsigned int)(dataByteLen - i);
-            if (partialBlock+instance->byteIOIndex > rateInBytes)
+            if (dataByteLen-i > rateInBytes-instance->byteIOIndex)
                 partialBlock = rateInBytes-instance->byteIOIndex;
+            else
+                partialBlock = (unsigned int)(dataByteLen - i);
             i += partialBlock;
 
             SnP_ExtractBytes(instance->state, curData, instance->byteIOIndex, partialBlock);

php-7.3.33.tar.xz/ext/ldap/ldap.c Changed

@@ -54,6 +54,7 @@
 
 #include "ext/standard/php_string.h"
 #include "ext/standard/info.h"
+#include "Zend/zend_exceptions.h"
 
 #ifdef HAVE_LDAP_SASL_H
 #include <sasl.h>
@@ -3868,13 +3869,23 @@
 	zend_string *ret;
 
 	for (i = 0; i < valuelen; i++) {
-		len += (map(unsigned char) valuei) ? 3 : 1;
+		size_t addend = (map(unsigned char) valuei) ? 3 : 1;
+		if (len > ZSTR_MAX_LEN - addend) {
+			return NULL;
+		}
+		len += addend;
 	}
 	/* Per RFC 4514, a leading and trailing space must be escaped */
 	if ((flags & PHP_LDAP_ESCAPE_DN) && (value0 == ' ')) {
+		if (len > ZSTR_MAX_LEN - 2) {
+			return NULL;
+		}
 		len += 2;
 	}
 	if ((flags & PHP_LDAP_ESCAPE_DN) && ((valuelen > 1) && (valuevaluelen - 1 == ' '))) {
+		if (len > ZSTR_MAX_LEN - 2) {
+			return NULL;
+		}
 		len += 2;
 	}
 
@@ -3941,7 +3952,13 @@
 		php_ldap_escape_map_set_chars(map, ignores, ignoreslen, 0);
 	}
 
-	RETURN_NEW_STR(php_ldap_do_escape(map, value, valuelen, flags));
+	zend_string *result = php_ldap_do_escape(map, value, valuelen, flags);
+	if (UNEXPECTED(!result)) {
+		zend_throw_exception(NULL, "Argument #1 ($value) is too long", 0);
+		return;
+	}
+
+	RETURN_NEW_STR(result);
 }
 
 #ifdef STR_TRANSLATION

php-7.3.33.tar.xz/ext/ldap/tests/GHSA-g665-fm4p-vhff-1.phpt Added

php-7.3.33.tar.xz/ext/ldap/tests/GHSA-g665-fm4p-vhff-2.phpt Added

php-7.3.33.tar.xz/ext/libxml/php_libxml.h Changed

@@ -120,6 +120,42 @@
 ZEND_TSRMLS_CACHE_EXTERN()
 #endif
 
+/* Other extension may override the global state options, these global options
+ * are copied initially to ctxt->options. Set the options to a known good value.
+ * See libxml2 globals.c and parserInternals.c.
+ * The unique_name argument allows multiple sanitizes and restores within the
+ * same function, even nested is necessary. */
+#define PHP_LIBXML_SANITIZE_GLOBALS(unique_name) \
+	int xml_old_loadsubset_##unique_name = xmlLoadExtDtdDefaultValue; \
+	xmlLoadExtDtdDefaultValue = 0; \
+	int xml_old_validate_##unique_name = xmlDoValidityCheckingDefaultValue; \
+	xmlDoValidityCheckingDefaultValue = 0; \
+	int xml_old_pedantic_##unique_name = xmlPedanticParserDefault(0); \
+	int xml_old_substitute_##unique_name = xmlSubstituteEntitiesDefault(0); \
+	int xml_old_linenrs_##unique_name = xmlLineNumbersDefault(0); \
+	int xml_old_blanks_##unique_name = xmlKeepBlanksDefault(1);
+
+#define PHP_LIBXML_RESTORE_GLOBALS(unique_name) \
+	xmlLoadExtDtdDefaultValue = xml_old_loadsubset_##unique_name; \
+	xmlDoValidityCheckingDefaultValue = xml_old_validate_##unique_name; \
+	(void) xmlPedanticParserDefault(xml_old_pedantic_##unique_name); \
+	(void) xmlSubstituteEntitiesDefault(xml_old_substitute_##unique_name); \
+	(void) xmlLineNumbersDefault(xml_old_linenrs_##unique_name); \
+	(void) xmlKeepBlanksDefault(xml_old_blanks_##unique_name);
+
+/* Alternative for above, working directly on the context and not setting globals.
+ * Generally faster because no locking is involved, and this has the advantage that it sets the options to a known good value. */
+static zend_always_inline void php_libxml_sanitize_parse_ctxt_options(xmlParserCtxtPtr ctxt)
+{
+	ctxt->loadsubset = 0;
+	ctxt->validate = 0;
+	ctxt->pedantic = 0;
+	ctxt->replaceEntities = 0;
+	ctxt->linenumbers = 0;
+	ctxt->keepBlanks = 1;
+	ctxt->options = 0;
+}
+
 #else /* HAVE_LIBXML */
 #define libxml_module_ptr NULL
 #endif

php-7.3.33.tar.xz/ext/mysqli/tests/fake_server.inc Added

@@ -0,0 +1,867 @@
+<?php
+
+function my_mysqli_data_fields()
+{
+    return 
+        'intval' => 
+            'type' => '03',
+            'charset' => '3f00',
+            'length' => '0b000000',
+            'flags' => '0110',
+            'decimal' => '00',
+            'query_data_packet_length' => '080000',
+            'query_data_value' => '023134',
+            'stmt_data_packet_length' => '0b0000',
+            'stmt_data_value' => '0e000000'
+        ,
+        'fltval' => 
+            'type' => '04',
+            'charset' => '3f00',
+            'length' => '0c000000',
+            'flags' => '0110',
+            'decimal' => '1f',
+            'query_data_packet_length' => '090000',
+            'query_data_value' => '03322e33',
+            'stmt_data_packet_length' => '0b0000',
+            'stmt_data_value' => '33331340',
+        ,
+        'dblval' => 
+            'type' => '05',
+            'charset' => '3f00',
+            'length' => '16000000',
+            'flags' => '0110',
+            'decimal' => '1f',
+            'query_data_packet_length' => '090000',
+            'query_data_value' => '03312e32',
+            'stmt_data_packet_length' => '0f0000',
+            'stmt_data_value' => '333333333333f33f'
+        ,
+        'datval' => 
+            'type' => '0a',
+            'charset' => '3f00',
+            'length' => '0a000000',
+            'flags' => '8110',
+            'decimal' => '00',
+            'query_data_packet_length' => '100000',
+            'query_data_value' => '0a323031342d31322d3135',
+            'stmt_data_packet_length' => '0c0000',
+            'stmt_data_value' => '04de070c0f'
+        ,
+        'timval' => 
+            'type' => '0b',
+            'charset' => '3f00',
+            'length' => '0a000000',
+            'flags' => '8110',
+            'decimal' => '00',
+            'query_data_packet_length' => '0e0000',
+            'query_data_value' => '0831333a30303a3032',
+            'stmt_data_packet_length' => '100000',
+            'stmt_data_value' => '080000000000150801'
+        ,
+        'dtival' => 
+            'type' => '0c',
+            'charset' => '3f00',
+            'length' => '13000000',
+            'flags' => '8110',
+            'decimal' => '00',
+            'query_data_packet_length' => '190000',
+            'query_data_value' => '13323031342d31322d31362031333a30303a3031',
+            'stmt_data_packet_length' => '0f0000',
+            'stmt_data_value' => '07de070c100d0001'
+        ,
+        'bitval' => 
+            'type' => '10',
+            'charset' => '3f00',
+            'length' => '40000000',
+            'flags' => '2110',
+            'decimal' => '00',
+            'query_data_packet_length' => '0e0000',
+            'query_data_value' => '080808080808080808',
+            'stmt_data_packet_length' => '100000',
+            'stmt_data_value' => '080808080808080808'
+        ,
+        'strval' => 
+            'type' => 'fd',
+            'charset' => 'e000',
+            'length' => 'c8000000',
+            'flags' => '0110',
+            'decimal' => '00',
+            'query_data_packet_length' => '0a0000',
+            'query_data_value' => '0474657374',
+            'stmt_data_packet_length' => '0c0000',
+            'stmt_data_value' => '0474657374'
+        ,
+    ;
+}
+
+function my_mysqli_data_field(string $field): array
+{
+    $fields = my_mysqli_data_fields();
+    if (!isset($fields$field)) {
+        throw new Exception("Unknown field $field");
+    }
+    return $fields$field;
+}
+
+
+
+class my_mysqli_fake_packet_item
+{
+    public function __construct($name, string $value, bool $is_hex = true)
+    {
+        $this->name   = $name;
+        $this->value  = $value;
+        $this->is_hex = $is_hex;
+    }
+}
+
+class my_mysqli_fake_packet
+{
+    private $data = array();
+
+    public function __get(string $name)
+    {
+        foreach ($this->data as $item) {
+            if ($item->name === $name) {
+                return $item->value;
+            }
+        }
+        return null;
+    }
+
+    public function __set(string $name, $value)
+    {
+        if ($value instanceof my_mysqli_fake_packet_item) {
+            if ($value->name === null) {
+                $value->name = $name;
+            }
+        } else {
+            $value = new my_mysqli_fake_packet_item($name, $value, true);
+        }
+
+        for ($i = 0; $i < count($this->data); $i++) {
+            if ($this->data$i->name === $name) {
+                $this->data$i = $value;
+                return;
+            }
+        }
+
+        $this->data = $value;
+    }
+
+    public function to_bytes()
+    {
+        $bytes = '';
+        foreach ($this->data as $item) {
+            $bytes .= $item->is_hex ? hex2bin($item->value) : $item->value;
+        }
+        return $bytes;
+    }
+}
+
+class my_mysqli_fake_packet_generator
+{
+    public static function create_packet_item($value, bool $is_hex = false, string $format = 'v')
+    {
+        if (is_string($value)) {
+            $packed_value = $value;
+        } else {
+            $packed_value = pack($format, $value);
+        }
+        return new my_mysqli_fake_packet_item(null, $packed_value, $is_hex);
+    }
+
+    public function server_ok()
+    {
+        $packet = new my_mysqli_fake_packet();
+        $packet->packet_length = "070000";
+        $packet->packet_number = "02";
+        $packet->header = "00"; // OK
+        $packet->affected_rows = "00";
+        $packet->last_insert_id = "00";
+        $packet->server_status = "0200";
+        $packet->warning_count = "0000";
+        return $packet;
+    }
+
+    public function server_greetings()
+    {
+        $packet = new my_mysqli_fake_packet();
+        $packet->packet_length = "580000";
+        $packet->packet_number = "00";
+        $packet->proto_version = "0a";
+        $packet->version = self::create_packet_item('5.5.5-10.5.18-MariaDB' . chr(0));
+        $packet->thread_id = "03000000";
+        $packet->salt = "473e3f6047257c67";
+        $packet->filler = "00";
+        $packet->server_capabilities = self::create_packet_item(0b1111011111111110);
+        $packet->server_character_set = "08";
+        $packet->server_status = self::create_packet_item(0b000000000000010);

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-auth-message.phpt Added

@@ -0,0 +1,37 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - auth message buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('auth_response_message_over_read', $port);
+$process->wait();
+
+try {
+    $conn = new mysqli( $servername, $username, $password, "", $port );
+    $info = mysqli_info($conn);
+    var_dump($info);
+} catch (Exception $e) {
+    echo $e->getMessage() . PHP_EOL;
+}
+
+$process->terminate();
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Malicious OK Auth Response Extract heap through buffer over-read: 0900000200000002000000fcff
+
+Warning: mysqli::__construct(): OK packet message length is past the packet size in %s on line %d
+%A

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-def.phpt Added

@@ -0,0 +1,47 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - tabular default)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('tabular_response_def_over_read', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Running query on the fake server...\n";
+
+$result = $conn->query("SELECT * from users");
+
+if ($result) {
+    $all_fields = $result->fetch_fields();
+    var_dump($result->fetch_all(MYSQLI_ASSOC));
+    var_dump(get_object_vars($all_fields0)"def");
+}
+
+$conn->close();
+
+$process->terminate();
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Running query on the fake server...
+* Received: 140000000353454c454354202a2066726f6d207573657273
+* Sending - Malicious Tabular Response Extract heap through buffer over-read: 01000001011e0000020164016401640164016401640c3f000b000000030350000000fd000001aa05000003fe00002200040000040135017405000005fe00002200
+
+Warning: mysqli::query(): Protocol error. Server sent default for unsupported field list (mysqlnd_wireprotocol.c:%d) in %s on line %d
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-filename.phpt Added

@@ -0,0 +1,43 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - upsert filename buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('upsert_response_filename_over_read', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+echo "* Running query on the fake server...\n";
+
+$result = $conn->query("SELECT * from users");
+$info = mysqli_info($conn);
+
+var_dump($info);
+
+$process->terminate();
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Running query on the fake server...
+* Received: 140000000353454c454354202a2066726f6d207573657273
+* Sending - Malicious Tabular Response Extract heap through buffer over-read: 0900000100000000000000fa65
+
+Warning: mysqli::query(): RSET_HEADER packet additional data length is past 249 bytes the packet size in %s on line %d
+
+Warning: mysqli::query(): Error reading result set's header in %s on line %d
+NULL
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-query-len-overflow.phpt Added

@@ -0,0 +1,48 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row no space for the field)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('query_response_row_length_overflow', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Query the fake server...\n";
+$sql = "SELECT strval, strval FROM data";
+
+$result = $conn->query($sql);
+
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row'strval');
+    }
+}
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Query the fake server...
+* Received: 200000000353454c4543542073747276616c2c2073747276616c2046524f4d2064617461
+* Sending - Malicious Query Response for data strval field length overflow: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd011000000005000004fe000022000a0000050474657374fefefefefe05000006fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after end of packet in %s on line %A
+* Received: 0100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-bit.phpt Added

@@ -0,0 +1,53 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row bit buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_over_read_bit', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Preparing statement on the fake server...\n";
+$stmt = $conn->prepare("SELECT bitval, timval FROM data");
+
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Fetch and display the results
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row"bitval");
+    }
+}
+$stmt->close();
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Preparing statement on the fake server...
+* Received: 200000001653454c4543542062697476616c2c2074696d76616c2046524f4d2064617461
+* Sending - Stmt prepare data bitval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610662697476616c0662697476616c0c3f004000000010211000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Malicious Stmt Response for data bitval Extract heap through buffer over-read: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610662697476616c0662697476616c0c3f004000000010211000000005000004fe00002200100000050000067465737408080808080808080805000006fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %A
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-date.phpt Added

@@ -0,0 +1,53 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row date buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_over_read_date', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Preparing statement on the fake server...\n";
+$stmt = $conn->prepare("SELECT strval, datval FROM data");
+
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Fetch and display the results
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row"datval");
+    }
+}
+$stmt->close();
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Preparing statement on the fake server...
+* Received: 200000001653454c4543542073747276616c2c2064617476616c2046524f4d2064617461
+* Sending - Stmt prepare data datval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664617476616c0664617476616c0c3f000a0000000a811000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Malicious Stmt Response for data datval Extract heap through buffer over-read: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664617476616c0664617476616c0c3f000a0000000a811000000005000004fe000022000c0000050000067465737404de070c0f05000006fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %A
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-datetime.phpt Added

@@ -0,0 +1,53 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row datetime buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_over_read_datetime', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Preparing statement on the fake server...\n";
+$stmt = $conn->prepare("SELECT strval, dtival FROM data");
+
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Fetch and display the results
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row"dtival");
+    }
+}
+$stmt->close();
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Preparing statement on the fake server...
+* Received: 200000001653454c4543542073747276616c2c2064746976616c2046524f4d2064617461
+* Sending - Stmt prepare data dtival: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664746976616c0664746976616c0c3f00130000000c811000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Malicious Stmt Response for data dtival Extract heap through buffer over-read: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664746976616c0664746976616c0c3f00130000000c811000000005000004fe000022000f0000050000067465737407de070c100d000105000006fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %A
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-double.phpt Added

@@ -0,0 +1,53 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row double buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_over_read_double', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Preparing statement on the fake server...\n";
+$stmt = $conn->prepare("SELECT strval, dblval FROM data");
+
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Fetch and display the results
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row"dblval");
+    }
+}
+$stmt->close();
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Preparing statement on the fake server...
+* Received: 200000001653454c4543542073747276616c2c2064626c76616c2046524f4d2064617461
+* Sending - Stmt prepare data dblval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664626c76616c0664626c76616c0c3f00160000000501101f000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Malicious Stmt Response for data dblval Extract heap through buffer over-read: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664626c76616c0664626c76616c0c3f00160000000501101f000005000004fe000022000f00000500000674657374333333333333f33f05000006fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %A
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-float.phpt Added

@@ -0,0 +1,53 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row int buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_over_read_float', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Preparing statement on the fake server...\n";
+$stmt = $conn->prepare("SELECT strval, fltval FROM data");
+
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Fetch and display the results
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row"fltval");
+    }
+}
+$stmt->close();
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Preparing statement on the fake server...
+* Received: 200000001653454c4543542073747276616c2c20666c7476616c2046524f4d2064617461
+* Sending - Stmt prepare data fltval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106666c7476616c06666c7476616c0c3f000c0000000401101f000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Malicious Stmt Response for data fltval Extract heap through buffer over-read: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106666c7476616c06666c7476616c0c3f000c0000000401101f000005000004fe000022000b000005000006746573743333134005000006fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %A
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-int.phpt Added

@@ -0,0 +1,53 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row int buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_over_read_int', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Preparing statement on the fake server...\n";
+$stmt = $conn->prepare("SELECT strval, intval FROM data");
+
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Fetch and display the results
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row"intval");
+    }
+}
+$stmt->close();
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Preparing statement on the fake server...
+* Received: 200000001653454c4543542073747276616c2c20696e7476616c2046524f4d2064617461
+* Sending - Stmt prepare data intval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106696e7476616c06696e7476616c0c3f000b00000003011000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Malicious Stmt Response for data intval Extract heap through buffer over-read: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106696e7476616c06696e7476616c0c3f000b00000003011000000005000004fe000022000b000005000006746573740e00000005000006fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %A
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-no-space.phpt Added

@@ -0,0 +1,53 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row no space for the field)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_no_space', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Preparing statement on the fake server...\n";
+$stmt = $conn->prepare("SELECT strval, strval FROM data");
+
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Fetch and display the results
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row"strval");
+    }
+}
+$stmt->close();
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Preparing statement on the fake server...
+* Received: 200000001653454c4543542073747276616c2c2073747276616c2046524f4d2064617461
+* Sending - Stmt prepare data strval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd011000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Malicious Stmt Response for data strval Extract heap through buffer over-read: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd011000000005000004fe000022000c00000500000974657374047465737405000006fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. No packet space left for the field in %s on line %A
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-string.phpt Added

@@ -0,0 +1,53 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row string buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_over_read_string', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Preparing statement on the fake server...\n";
+$stmt = $conn->prepare("SELECT item FROM items");
+
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Fetch and display the results
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row"item");
+    }
+}
+$stmt->close();
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Preparing statement on the fake server...
+* Received: 170000001653454c454354206974656d2046524f4d206974656d73
+* Sending - Stmt prepare items: 0c0000010001000000010000000000003000000203646566087068705f74657374056974656d73056974656d73046974656d046974656d0ce000c8000000fd011000000005000003fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Malicious Stmt Response for items Extract heap through buffer over-read: 01000001013000000203646566087068705f74657374056974656d73056974656d73046974656d046974656d0ce000c8000000fd011000000005000003fe00002200070000040000fa7465737405000005fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %A
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-time.phpt Added

@@ -0,0 +1,53 @@
+--TEST--
+GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row time buffer over-read)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_over_read_time', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+echo "* Preparing statement on the fake server...\n";
+$stmt = $conn->prepare("SELECT strval, timval FROM data");
+
+$stmt->execute();
+$result = $stmt->get_result();
+
+// Fetch and display the results
+if ($result->num_rows > 0) {
+    while ($row = $result->fetch_assoc()) {
+        var_dump($row"timval");
+    }
+}
+$stmt->close();
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECTF--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Preparing statement on the fake server...
+* Received: 200000001653454c4543542073747276616c2c2074696d76616c2046524f4d2064617461
+* Sending - Stmt prepare data timval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610674696d76616c0674696d76616c0c3f000a0000000b811000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Malicious Stmt Response for data timval Extract heap through buffer over-read: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610674696d76616c0674696d76616c0c3f000a0000000b811000000005000004fe000022001000000500000c7465737408000000000015080105000006fe00002200
+
+Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %A
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/mysqli_change_user_new.phpt Changed

php-7.3.33.tar.xz/ext/mysqli/tests/mysqli_pconn_max_links.phpt Changed

php-7.3.33.tar.xz/ext/mysqli/tests/mysqli_stmt_get_result_metadata_fetch_field.phpt Changed

php-7.3.33.tar.xz/ext/mysqli/tests/protocol_query_row_fetch_data.phpt Added

@@ -0,0 +1,74 @@
+--TEST--
+MySQL protocol - statement row data fetch)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('query_response_row_read_two_fields', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+function my_query($conn, $field)
+{
+    $sql = "SELECT strval, $field FROM data";
+
+    $result = $conn->query($sql);
+
+    if ($result->num_rows > 0) {
+        while ($row = $result->fetch_assoc()) {
+            var_dump($row$field);
+        }
+    }
+}
+
+foreach (my_mysqli_data_fields() as $field_name => $field) {
+    my_query($conn, $field_name);
+}
+
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECT--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Received: 200000000353454c4543542073747276616c2c20696e7476616c2046524f4d2064617461
+* Sending - Query execute data intval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106696e7476616c06696e7476616c0c3f000b00000003011000000005000004fe0000220008000005047465737402313405000006fe00002200
+string(2) "14"
+* Received: 200000000353454c4543542073747276616c2c20666c7476616c2046524f4d2064617461
+* Sending - Query execute data fltval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106666c7476616c06666c7476616c0c3f000c0000000401101f000005000004fe0000220009000005047465737403322e3305000006fe00002200
+string(3) "2.3"
+* Received: 200000000353454c4543542073747276616c2c2064626c76616c2046524f4d2064617461
+* Sending - Query execute data dblval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664626c76616c0664626c76616c0c3f00160000000501101f000005000004fe0000220009000005047465737403312e3205000006fe00002200
+string(3) "1.2"
+* Received: 200000000353454c4543542073747276616c2c2064617476616c2046524f4d2064617461
+* Sending - Query execute data datval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664617476616c0664617476616c0c3f000a0000000a811000000005000004fe000022001000000504746573740a323031342d31322d313505000006fe00002200
+string(10) "2014-12-15"
+* Received: 200000000353454c4543542073747276616c2c2074696d76616c2046524f4d2064617461
+* Sending - Query execute data timval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610674696d76616c0674696d76616c0c3f000a0000000b811000000005000004fe000022000e00000504746573740831333a30303a303205000006fe00002200
+string(8) "13:00:02"
+* Received: 200000000353454c4543542073747276616c2c2064746976616c2046524f4d2064617461
+* Sending - Query execute data dtival: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664746976616c0664746976616c0c3f00130000000c811000000005000004fe0000220019000005047465737413323031342d31322d31362031333a30303a303105000006fe00002200
+string(19) "2014-12-16 13:00:01"
+* Received: 200000000353454c4543542073747276616c2c2062697476616c2046524f4d2064617461
+* Sending - Query execute data bitval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610662697476616c0662697476616c0c3f004000000010211000000005000004fe000022000e000005047465737408080808080808080805000006fe00002200
+string(18) "578721382704613384"
+* Received: 200000000353454c4543542073747276616c2c2073747276616c2046524f4d2064617461
+* Sending - Query execute data strval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd011000000005000004fe000022000a0000050474657374047465737405000006fe00002200
+string(4) "test"
+* Received: 0100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqli/tests/protocol_stmt_row_fetch_data.phpt Added

@@ -0,0 +1,91 @@
+--TEST--
+MySQL protocol - statement row data fetch)
+--EXTENSIONS--
+mysqli
+--FILE--
+<?php
+require_once 'fake_server.inc';
+
+$port = 33305;
+$servername = "127.0.0.1";
+$username = "root";
+$password = "";
+
+$process = run_fake_server_in_background('stmt_response_row_read_two_fields', $port);
+$process->wait();
+
+$conn = new mysqli($servername, $username, $password, "", $port);
+
+function my_query($conn, $field)
+{
+    $stmt = $conn->prepare("SELECT strval, $field FROM data");
+
+    $stmt->execute();
+    $result = $stmt->get_result();
+
+    if ($result->num_rows > 0) {
+        while ($row = $result->fetch_assoc()) {
+            var_dump($row$field);
+        }
+    }
+}
+
+foreach (my_mysqli_data_fields() as $field_name => $field) {
+    my_query($conn, $field_name);
+}
+
+$conn->close();
+
+$process->terminate(true);
+
+print "done!";
+?>
+--EXPECT--
+* Server started
+* Connection established
+* Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
+* Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
+* Sending - Server OK: 0700000200000002000000
+* Received: 200000001653454c4543542073747276616c2c20696e7476616c2046524f4d2064617461
+* Sending - Stmt prepare data intval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106696e7476616c06696e7476616c0c3f000b00000003011000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Stmt execute data intval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106696e7476616c06696e7476616c0c3f000b00000003011000000005000004fe000022000b000005000004746573740e00000005000006fe00002200
+int(14)
+* Received: 050000001901000000200000001653454c4543542073747276616c2c20666c7476616c2046524f4d2064617461
+* Sending - Stmt prepare data fltval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106666c7476616c06666c7476616c0c3f000c0000000401101f000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Stmt execute data fltval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f746573740464617461046461746106666c7476616c06666c7476616c0c3f000c0000000401101f000005000004fe000022000b000005000004746573743333134005000006fe00002200
+float(2.3)
+* Received: 050000001901000000200000001653454c4543542073747276616c2c2064626c76616c2046524f4d2064617461
+* Sending - Stmt prepare data dblval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664626c76616c0664626c76616c0c3f00160000000501101f000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Stmt execute data dblval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664626c76616c0664626c76616c0c3f00160000000501101f000005000004fe000022000f00000500000474657374333333333333f33f05000006fe00002200
+float(1.2)
+* Received: 050000001901000000200000001653454c4543542073747276616c2c2064617476616c2046524f4d2064617461
+* Sending - Stmt prepare data datval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664617476616c0664617476616c0c3f000a0000000a811000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Stmt execute data datval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664617476616c0664617476616c0c3f000a0000000a811000000005000004fe000022000c0000050000047465737404de070c0f05000006fe00002200
+string(10) "2014-12-15"
+* Received: 050000001901000000200000001653454c4543542073747276616c2c2074696d76616c2046524f4d2064617461
+* Sending - Stmt prepare data timval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610674696d76616c0674696d76616c0c3f000a0000000b811000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Stmt execute data timval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610674696d76616c0674696d76616c0c3f000a0000000b811000000005000004fe00002200100000050000047465737408000000000015080105000006fe00002200
+string(8) "21:08:01"
+* Received: 050000001901000000200000001653454c4543542073747276616c2c2064746976616c2046524f4d2064617461
+* Sending - Stmt prepare data dtival: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664746976616c0664746976616c0c3f00130000000c811000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Stmt execute data dtival: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664746976616c0664746976616c0c3f00130000000c811000000005000004fe000022000f0000050000047465737407de070c100d000105000006fe00002200
+string(19) "2014-12-16 13:00:01"
+* Received: 050000001901000000200000001653454c4543542073747276616c2c2062697476616c2046524f4d2064617461
+* Sending - Stmt prepare data bitval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610662697476616c0662697476616c0c3f004000000010211000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Stmt execute data bitval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610662697476616c0662697476616c0c3f004000000010211000000005000004fe00002200100000050000047465737408080808080808080805000006fe00002200
+int(578721382704613384)
+* Received: 050000001901000000200000001653454c4543542073747276616c2c2073747276616c2046524f4d2064617461
+* Sending - Stmt prepare data strval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd011000000005000004fe00000200
+* Received: 0a00000017010000000001000000
+* Sending - Stmt execute data strval: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd011000000005000004fe000022000c00000500000474657374047465737405000006fe00002200
+string(4) "test"
+* Received: 0500000019010000000100000001
+* Server finished
+done!

php-7.3.33.tar.xz/ext/mysqlnd/mysqlnd_ps_codec.c Changed

@@ -52,6 +52,37 @@
 #define MYSQLND_PS_SKIP_RESULT_W_LEN	-1
 #define MYSQLND_PS_SKIP_RESULT_STR		-2
 
+static inline void ps_fetch_over_read_error(const zend_uchar ** row)
+{
+	php_error_docref(NULL, E_WARNING, "Malformed server packet. Field length pointing after the end of packet");
+	*row = NULL;
+}
+
+static inline zend_bool ps_fetch_is_packet_over_read_with_variable_length(const unsigned int pack_len,
+		const zend_uchar ** row, const zend_uchar *p, unsigned int length)
+{
+	if (pack_len == 0) {
+		return 0;
+	}
+	size_t length_len = *row - p;
+	if (length_len > pack_len || length > pack_len - length_len) {
+		ps_fetch_over_read_error(row);
+		return 1;
+	}
+	return 0;
+}
+
+static inline zend_bool ps_fetch_is_packet_over_read_with_static_length(const unsigned int pack_len,
+		const zend_uchar ** row, unsigned int length)
+{
+	if (pack_len > 0 && length > pack_len) {
+		ps_fetch_over_read_error(row);
+		return 1;
+	}
+	return 0;
+}
+
+
 /* {{{ ps_fetch_from_1_to_8_bytes */
 void
 ps_fetch_from_1_to_8_bytes(zval * zv, const MYSQLND_FIELD * const field, const unsigned int pack_len,
@@ -60,6 +91,11 @@
 	char tmp22;
 	size_t tmp_len = 0;
 	zend_bool is_bit = field->type == MYSQL_TYPE_BIT;
+
+	if (UNEXPECTED(ps_fetch_is_packet_over_read_with_static_length(pack_len, row, byte_count))) {
+		return;
+	}
+
 	DBG_ENTER("ps_fetch_from_1_to_8_bytes");
 	DBG_INF_FMT("zv=%p byte_count=%u", zv, byte_count);
 	if (field->flags & UNSIGNED_FLAG) {
@@ -178,6 +214,11 @@
 	float fval;
 	double dval;
 	DBG_ENTER("ps_fetch_float");
+
+	if (UNEXPECTED(ps_fetch_is_packet_over_read_with_static_length(pack_len, row, 4))) {
+		return;
+	}
+
 	float4get(fval, *row);
 	(*row)+= 4;
 	DBG_INF_FMT("value=%f", fval);
@@ -200,6 +241,11 @@
 {
 	double value;
 	DBG_ENTER("ps_fetch_double");
+
+	if (UNEXPECTED(ps_fetch_is_packet_over_read_with_static_length(pack_len, row, 8))) {
+		return;
+	}
+
 	float8get(value, *row);
 	ZVAL_DOUBLE(zv, value);
 	(*row)+= 8;
@@ -216,9 +262,14 @@
 	struct st_mysqlnd_time t;
 	zend_ulong length; /* First byte encodes the length*/
 	char * value;
+	const zend_uchar *p = *row;
 	DBG_ENTER("ps_fetch_time");
 
 	if ((length = php_mysqlnd_net_field_length(row))) {
+		if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) {
+			return;
+		}
+
 		const zend_uchar * to = *row;
 
 		t.time_type = MYSQLND_TIMESTAMP_TIME;
@@ -273,9 +324,14 @@
 	struct st_mysqlnd_time t = {0};
 	zend_ulong length; /* First byte encodes the length*/
 	char * value;
+	const zend_uchar *p = *row;
 	DBG_ENTER("ps_fetch_date");
 
 	if ((length = php_mysqlnd_net_field_length(row))) {
+		if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) {
+			return;
+		}
+
 		const zend_uchar * to = *row;
 
 		t.time_type = MYSQLND_TIMESTAMP_DATE;
@@ -310,9 +366,14 @@
 	struct st_mysqlnd_time t;
 	zend_ulong length; /* First byte encodes the length*/
 	char * value;
+	const zend_uchar *p = *row;
 	DBG_ENTER("ps_fetch_datetime");
 
 	if ((length = php_mysqlnd_net_field_length(row))) {
+		if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) {
+			return;
+		}
+
 		const zend_uchar * to = *row;
 
 		t.time_type = MYSQLND_TIMESTAMP_DATETIME;
@@ -371,7 +432,11 @@
 	  For now just copy, before we make it possible
 	  to write \0 to the row buffer
 	*/
+	const zend_uchar *p = *row;
 	const zend_ulong length = php_mysqlnd_net_field_length(row);
+	if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) {
+		return;
+	}
 	DBG_ENTER("ps_fetch_string");
 	DBG_INF_FMT("len = %lu", length);
 	DBG_INF("copying from the row buffer");
@@ -387,7 +452,11 @@
 static void
 ps_fetch_bit(zval * zv, const MYSQLND_FIELD * const field, const unsigned int pack_len, const zend_uchar ** row)
 {
+	const zend_uchar *p = *row;
 	const zend_ulong length = php_mysqlnd_net_field_length(row);
+	if (UNEXPECTED(ps_fetch_is_packet_over_read_with_variable_length(pack_len, row, p, length))) {
+		return;
+	}
 	ps_fetch_from_1_to_8_bytes(zv, field, pack_len, row, length);
 }
 /* }}} */

php-7.3.33.tar.xz/ext/mysqlnd/mysqlnd_result.c Changed

php-7.3.33.tar.xz/ext/mysqlnd/mysqlnd_wireprotocol.c Changed

@@ -442,8 +442,31 @@
 	if (packet->server_capabilities & CLIENT_PLUGIN_AUTH) {
 		BAIL_IF_NO_MORE_DATA;
 		/* The server is 5.5.x and supports authentication plugins */
-		packet->auth_protocol = estrdup((char *)p);
-		p+= strlen(packet->auth_protocol) + 1; /* eat the '\0' */
+		size_t remaining_size = packet->header.size - (size_t)(p - buf);
+		if (remaining_size == 0) {
+			/* Might be better to fail but this will fail anyway */
+			packet->auth_protocol = estrdup("");
+		} else {
+			/* Check if NUL present */
+			char *null_terminator = memchr(p, '\0', remaining_size);
+			size_t auth_protocol_len;
+			if (null_terminator) {
+				/* If present, do basically estrdup */
+				auth_protocol_len = null_terminator - (char *)p;
+			} else {
+				/* If not present, copy the rest of the buffer */
+				auth_protocol_len = remaining_size;
+			}
+			char *auth_protocol = emalloc(auth_protocol_len + 1);
+			memcpy(auth_protocol, p, auth_protocol_len);
+			auth_protocolauth_protocol_len = '\0';
+			packet->auth_protocol = auth_protocol;
+
+			p += auth_protocol_len;
+			if (null_terminator) {
+				p++;
+			}
+		}
 	}
 
 	DBG_INF_FMT("proto=%u server=%s thread_id=%u",
@@ -712,7 +735,14 @@
 
 		/* There is a message */
 		if (packet->header.size > (size_t) (p - buf) && (net_len = php_mysqlnd_net_field_length(&p))) {
-			packet->message_len = MIN(net_len, buf_len - (p - begin));
+			/* p can get past packet size when getting field length so it needs to be checked first
+			 * and after that it can be checked that the net_len is not greater than the packet size */
+			if ((p - buf) > packet->header.size || packet->header.size - (p - buf) < net_len) {
+				DBG_ERR_FMT("OK packet message length is past the packet size");
+				php_error_docref(NULL, E_WARNING, "OK packet message length is past the packet size");
+				DBG_RETURN(FAIL);
+			}
+			packet->message_len = net_len;
 			packet->message = mnd_pestrndup((char *)p, packet->message_len, FALSE);
 		} else {
 			packet->message = NULL;
@@ -768,7 +798,8 @@
 	MYSQLND_VIO * vio = conn->vio;
 	MYSQLND_STATS * stats = conn->stats;
 	MYSQLND_CONNECTION_STATE * connection_state = &conn->state;
-	zend_uchar * buffer = pfc->cmd_buffer.length >= packet->auth_data_len? pfc->cmd_buffer.buffer : mnd_emalloc(packet->auth_data_len);
+	size_t total_packet_size = packet->auth_data_len + MYSQLND_HEADER_SIZE;
+	zend_uchar * const buffer = pfc->cmd_buffer.length >= total_packet_size? pfc->cmd_buffer.buffer : mnd_emalloc(total_packet_size);
 	zend_uchar * p = buffer + MYSQLND_HEADER_SIZE; /* start after the header */
 
 	DBG_ENTER("php_mysqlnd_change_auth_response_write");
@@ -1105,6 +1136,17 @@
 			BAIL_IF_NO_MORE_DATA;
 			/* Check for additional textual data */
 			if (packet->header.size  > (size_t) (p - buf) && (len = php_mysqlnd_net_field_length(&p))) {
+				/* p can get past packet size when getting field length so it needs to be checked first
+				 * and after that it can be checked that the len is not greater than the packet size */
+				if ((p - buf) > packet->header.size || packet->header.size - (p - buf) < len) {
+					size_t local_file_name_over_read = ((p - buf) - packet->header.size) + len;
+					DBG_ERR_FMT("RSET_HEADER packet additional data length is past %zu bytes the packet size",
+						local_file_name_over_read);
+					php_error_docref(NULL, E_WARNING,
+						"RSET_HEADER packet additional data length is past %zu bytes the packet size",
+						local_file_name_over_read);
+					DBG_RETURN(FAIL);
+				}
 				packet->info_or_local_file.s = mnd_emalloc(len + 1);
 				if (packet->info_or_local_file.s) {
 					memcpy(packet->info_or_local_file.s, p, len);
@@ -1261,23 +1303,16 @@
 		meta->flags |= NUM_FLAG;
 	}
 
-
-	/*
-	  def could be empty, thus don't allocate on the root.
-	  NULL_LENGTH (0xFB) comes from COM_FIELD_LIST when the default value is NULL.
-	  Otherwise the string is length encoded.
-	*/
+	/* COM_FIELD_LIST is no longer supported so def should not be present */
 	if (packet->header.size > (size_t) (p - buf) &&
 		(len = php_mysqlnd_net_field_length(&p)) &&
 		len != MYSQLND_NULL_LENGTH)
 	{
-		BAIL_IF_NO_MORE_DATA;
-		DBG_INF_FMT("Def found, length %lu", len);
-		meta->def = packet->memory_pool->get_chunk(packet->memory_pool, len + 1);
-		memcpy(meta->def, p, len);
-		meta->deflen = '\0';
-		meta->def_length = len;
-		p += len;
+		DBG_ERR_FMT("Protocol error. Server sent default for unsupported field list");
+		php_error_docref(NULL, E_WARNING,
+			"Protocol error. Server sent default for unsupported field list (mysqlnd_wireprotocol.c:%u)",
+			__LINE__);
+		DBG_RETURN(FAIL);
 	}
 
 	root_ptr = meta->root = packet->memory_pool->get_chunk(packet->memory_pool, total_len);
@@ -1438,8 +1473,10 @@
 									  unsigned int field_count, const MYSQLND_FIELD * fields_metadata,
 									  zend_bool as_int_or_float, MYSQLND_STATS * stats)
 {
-	unsigned int i;
-	const zend_uchar * p = row_buffer->ptr;
+	unsigned int i, j;
+	size_t rbs = row_buffer->size;
+	const zend_uchar * rbp = row_buffer->ptr;
+	const zend_uchar * p = rbp;
 	const zend_uchar * null_ptr;
 	zend_uchar bit;
 	zval *current_field, *end_field, *start_field;
@@ -1472,7 +1509,21 @@
 			statistic = STAT_BINARY_TYPE_FETCHED_NULL;
 		} else {
 			enum_mysqlnd_field_types type = fields_metadatai.type;
-			mysqlnd_ps_fetch_functionstype.func(current_field, &fields_metadatai, 0, &p);
+			size_t row_position = p - rbp;
+			if (rbs <= row_position) {
+				for (j = 0, current_field = start_field; j < i; current_field++, j++) {
+					zval_ptr_dtor(current_field);
+				}
+				php_error_docref(NULL, E_WARNING, "Malformed server packet. No packet space left for the field");
+				DBG_RETURN(FAIL);
+			}
+			mysqlnd_ps_fetch_functionstype.func(current_field, &fields_metadatai, rbs - row_position, &p);
+			if (p == NULL) {
+				for (j = 0, current_field = start_field; j < i; current_field++, j++) {
+					zval_ptr_dtor(current_field);
+				}
+				DBG_RETURN(FAIL);
+			}
 
 			if (MYSQLND_G(collect_statistics)) {
 				switch (fields_metadatai.type) {
@@ -1529,7 +1580,7 @@
 									unsigned int field_count, const MYSQLND_FIELD * fields_metadata,
 									zend_bool as_int_or_float, MYSQLND_STATS * stats)
 {
-	unsigned int i;
+	unsigned int i, j;
 	zval *current_field, *end_field, *start_field;
 	zend_uchar * p = row_buffer->ptr;
 	size_t data_size = row_buffer->size;
@@ -1550,9 +1601,11 @@
 		/* NULL or NOT NULL, this is the question! */
 		if (len == MYSQLND_NULL_LENGTH) {
 			ZVAL_NULL(current_field);
-		} else if ((p + len) > packet_end) {
-			php_error_docref(NULL, E_WARNING, "Malformed server packet. Field length pointing "MYSQLND_SZ_T_SPEC
-											  " bytes after end of packet", (p + len) - packet_end - 1);
+		} else if (p > packet_end || len > packet_end - p) {
+			php_error_docref(NULL, E_WARNING, "Malformed server packet. Field length pointing after end of packet");
+			for (j = 0, current_field = start_field; j < i; current_field++, j++) {
+				zval_ptr_dtor(current_field);
+			}
 			DBG_RETURN(FAIL);
 		} else {
 #if defined(MYSQLND_STRING_TO_INT_CONVERSION)

php-7.3.33.tar.xz/ext/openssl/openssl.c Changed

php-7.3.33.tar.xz/ext/openssl/tests/gh22186.phpt Added

@@ -0,0 +1,32 @@
+--TEST--
+GH-22186 (Heap buffer overflow in openssl_encrypt with AES-WRAP-PAD)
+--EXTENSIONS--
+openssl
+--SKIPIF--
+<?php
+/* openssl_get_cipher_methods() enumerates provider ciphers, but openssl_encrypt()
+ * resolves names via the legacy EVP_get_cipherbyname(), so on some builds the
+ * cipher is listed yet not usable. Probe the actual call path instead. */
+if (!@openssl_encrypt("test", "aes-128-wrap-pad", str_repeat("k", 16),
+        OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, str_repeat("\0", 4))) {
+    die('skip aes-128-wrap-pad not usable on this OpenSSL build');
+}
+?>
+--FILE--
+<?php
+$pass = str_repeat("k", 16);
+$iv = str_repeat("\0", 4);
+
+for ($i = 1; $i < 258; $i++) {
+    $data = str_repeat("a", $i);
+    $enc = openssl_encrypt($data, 'aes-128-wrap-pad', $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv);
+    $dec = openssl_decrypt($enc, 'aes-128-wrap-pad', $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv);
+    if ($dec !== $data) {
+        die("mismatch at $i\n");
+    }
+}
+
+echo "done\n";
+?>
+--EXPECT--
+done

php-7.3.33.tar.xz/ext/pdo/pdo_sql_parser.c Changed

@@ -1,4 +1,5 @@
 /* Generated by re2c 1.0.3 */
+#line 1 "ext/pdo/pdo_sql_parser.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
@@ -44,9 +45,11 @@
 	char *cursor = s->cur;
 
 	s->tok = cursor;
+	#line 53 "ext/pdo/pdo_sql_parser.re"
 
 
 	
+#line 53 "ext/pdo/pdo_sql_parser.c"
 {
 	YYCTYPE yych;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
@@ -91,12 +94,16 @@
 	default:	goto yy3;
 	}
 yy5:
+#line 63 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 100 "ext/pdo/pdo_sql_parser.c"
 yy6:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych >= 0x01) goto yy16;
 yy7:
+#line 61 "ext/pdo/pdo_sql_parser.re"
 	{ SKIP_ONE(PDO_PARSER_TEXT); }
+#line 107 "ext/pdo/pdo_sql_parser.c"
 yy8:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= 0x00) goto yy7;
@@ -192,7 +199,9 @@
 	default:	goto yy14;
 	}
 yy14:
+#line 60 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_BIND_POS); }
+#line 205 "ext/pdo/pdo_sql_parser.c"
 yy15:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -206,7 +215,9 @@
 	}
 yy17:
 	++YYCURSOR;
+#line 56 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 221 "ext/pdo/pdo_sql_parser.c"
 yy19:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -226,7 +237,9 @@
 	}
 yy22:
 	++YYCURSOR;
+#line 57 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 243 "ext/pdo/pdo_sql_parser.c"
 yy24:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -243,7 +256,9 @@
 	default:	goto yy25;
 	}
 yy27:
+#line 62 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 262 "ext/pdo/pdo_sql_parser.c"
 yy28:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -323,7 +338,9 @@
 	default:	goto yy32;
 	}
 yy32:
+#line 59 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_BIND); }
+#line 344 "ext/pdo/pdo_sql_parser.c"
 yy33:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -333,7 +350,9 @@
 	default:	goto yy35;
 	}
 yy35:
+#line 58 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
+#line 356 "ext/pdo/pdo_sql_parser.c"
 yy36:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -355,6 +374,7 @@
 	++YYCURSOR;
 	goto yy27;
 }
+#line 64 "ext/pdo/pdo_sql_parser.re"
 
 }

php-7.3.33.tar.xz/ext/pdo_dblib/dblib_driver.c Changed

php-7.3.33.tar.xz/ext/pdo_dblib/tests/GHSA-5hqh-c84r-qjcv.phpt Added

php-7.3.33.tar.xz/ext/pdo_firebird/firebird_driver.c Changed

php-7.3.33.tar.xz/ext/pdo_sqlite/sqlite_driver.c Changed

php-7.3.33.tar.xz/ext/pdo_sqlite/tests/bug81740.phpt Added

php-7.3.33.tar.xz/ext/pgsql/pgsql.c Changed

@@ -1994,7 +1994,7 @@
 				if (Z_TYPE(tmp_val) != IS_STRING) {
 					php_error_docref(NULL, E_WARNING,"Error converting parameter");
 					zval_ptr_dtor(&tmp_val);
-					_php_pgsql_free_params(params, num_params);
+					_php_pgsql_free_params(params, i);
 					RETURN_FALSE;
 				}
 				paramsi = estrndup(Z_STRVAL(tmp_val), Z_STRLEN(tmp_val));
@@ -5179,7 +5179,7 @@
 				if (Z_TYPE(tmp_val) != IS_STRING) {
 					php_error_docref(NULL, E_WARNING,"Error converting parameter");
 					zval_ptr_dtor(&tmp_val);
-					_php_pgsql_free_params(params, num_params);
+					_php_pgsql_free_params(params, i);
 					RETURN_FALSE;
 				}
 				paramsi = estrndup(Z_STRVAL(tmp_val), Z_STRLEN(tmp_val));
@@ -5814,7 +5814,6 @@
 	assert(Z_TYPE_P(src) == IS_STRING);
 	assert(should_free == 1 || should_free == 0);
 
-	smart_str_appendc(&str, 'E');
 	smart_str_appendc(&str, '\'');
 	smart_str_appendl(&str, Z_STRVAL_P(src), Z_STRLEN_P(src));
 	smart_str_appendc(&str, '\'');
@@ -6100,7 +6099,6 @@
 							zend_string *str;
 							/* PostgreSQL ignores \0 */
 							str = zend_string_alloc(Z_STRLEN_P(val) * 2, 0);
-							/* better to use PGSQLescapeLiteral since PGescapeStringConn does not handle special \ */
 							ZSTR_LEN(str) = PQescapeStringConn(pg_link, ZSTR_VAL(str), Z_STRVAL_P(val), Z_STRLEN_P(val), NULL);
 							str = zend_string_truncate(str, ZSTR_LEN(str), 0);
 							ZVAL_NEW_STR(&new_val, str);

php-7.3.33.tar.xz/ext/pgsql/tests/10pg_convert_9.phpt Changed

php-7.3.33.tar.xz/ext/pgsql/tests/10pg_convert_json_array.phpt Changed

php-7.3.33.tar.xz/ext/pgsql/tests/12pg_insert_9.phpt Changed

php-7.3.33.tar.xz/ext/pgsql/tests/14pg_update_9.phpt Changed

php-7.3.33.tar.xz/ext/pgsql/tests/GHSA-7qpv-r5mr-78m4.phpt Added

@@ -0,0 +1,48 @@
+--TEST--
+GHSA-7qpv-r5mr-78m4: SQL injection via E'...' backslash breakout
+--CREDITS--
+expatch.llc
+--SKIPIF--
+<?php include("skipif.inc"); ?>
+--FILE--
+<?php
+include 'config.inc';
+
+$db = pg_connect($conn_str);
+
+pg_query($db, "SET standard_conforming_strings = 1");
+
+pg_query($db, "DROP TABLE IF EXISTS ghsa_7qpv_r5mr_78m4");
+pg_query($db, "CREATE TABLE ghsa_7qpv_r5mr_78m4 (id serial primary key, name text, admin boolean)");
+pg_query($db, "INSERT INTO ghsa_7qpv_r5mr_78m4 (name, admin) VALUES ('alice', false), ('bob', false)");
+
+$params = 'name' => "zzz' OR 1=1 --";
+var_dump(pg_select($db, 'ghsa_7qpv_r5mr_78m4', $params));
+
+$params = 'name' => "zzz\\' OR 1=1 --";
+var_dump(pg_select($db, 'ghsa_7qpv_r5mr_78m4', $params));
+
+$params = 'name' => "john\\', true) --", 'admin' => 'false';
+echo pg_insert($db, 'ghsa_7qpv_r5mr_78m4', $params, PGSQL_DML_STRING) . "\n";
+pg_insert($db, 'ghsa_7qpv_r5mr_78m4', $params);
+var_dump(pg_select($db, 'ghsa_7qpv_r5mr_78m4', 'id' => 3)0'admin');
+
+$params = 'name' => "jake\\', true) --", 'admin' => 'f';
+echo pg_insert($db, 'ghsa_7qpv_r5mr_78m4', $params, PGSQL_DML_ESCAPE|PGSQL_DML_STRING) . "\n";
+pg_insert($db, 'ghsa_7qpv_r5mr_78m4', $params, PGSQL_DML_EXEC|PGSQL_DML_ESCAPE);
+var_dump(pg_select($db, 'ghsa_7qpv_r5mr_78m4', 'id' => 4)0'admin');
+
+?>
+--EXPECT--
+bool(false)
+bool(false)
+INSERT INTO "ghsa_7qpv_r5mr_78m4" ("name","admin") VALUES ('john\'', true) --','f');
+string(1) "f"
+INSERT INTO "ghsa_7qpv_r5mr_78m4" ("name","admin") VALUES ('jake\'', true) --','f');
+string(1) "f"
+--CLEAN--
+<?php
+include('config.inc');
+$db = pg_connect($conn_str);
+pg_query($db, "DROP TABLE IF EXISTS ghsa_7qpv_r5mr_78m4");
+?>

php-7.3.33.tar.xz/ext/pgsql/tests/bug64609.phpt Changed

php-7.3.33.tar.xz/ext/pgsql/tests/bug68638.phpt Changed

php-7.3.33.tar.xz/ext/pgsql/tests/bug81720.phpt Added

php-7.3.33.tar.xz/ext/phar/dirstream.c Changed

@@ -92,25 +92,28 @@
  */
 static size_t phar_dir_read(php_stream *stream, char *buf, size_t count) /* {{{ */
 {
-	size_t to_read;
 	HashTable *data = (HashTable *)stream->abstract;
 	zend_string *str_key;
 	zend_ulong unused;
 
+	if (count != sizeof(php_stream_dirent)) {
+		return -1;
+	}
+
 	if (HASH_KEY_NON_EXISTENT == zend_hash_get_current_key(data, &str_key, &unused)) {
 		return 0;
 	}
 
 	zend_hash_move_forward(data);
-	to_read = MIN(ZSTR_LEN(str_key), count);
 
-	if (to_read == 0 || count < ZSTR_LEN(str_key)) {
+	php_stream_dirent *dirent = (php_stream_dirent *) buf;
+
+	if (sizeof(dirent->d_name) <= ZSTR_LEN(str_key)) {
 		return 0;
 	}
 
-	memset(buf, 0, sizeof(php_stream_dirent));
-	memcpy(((php_stream_dirent *) buf)->d_name, ZSTR_VAL(str_key), to_read);
-	((php_stream_dirent *) buf)->d_nameto_read + 1 = '\0';
+	memset(dirent, 0, sizeof(php_stream_dirent));
+	PHP_STRLCPY(dirent->d_name, ZSTR_VAL(str_key), sizeof(dirent->d_name), ZSTR_LEN(str_key));
 
 	return sizeof(php_stream_dirent);
 }

php-7.3.33.tar.xz/ext/phar/phar.c Changed

@@ -1594,6 +1594,7 @@
 	const char gz_magic = "\x1f\x8b\x08";
 	const char bz_magic = "BZh";
 	char *pos, test = '\0';
+	int recursion_count = 3; // arbitrary limit to avoid too deep or even infinite recursion
 	const int window_size = 1024;
 	char buffer1024 + sizeof(token); /* a 1024 byte window + the size of the halt_compiler token (moving window) */
 	const zend_long readsize = sizeof(buffer) - sizeof(token);
@@ -1621,7 +1622,7 @@
 			MAPPHAR_ALLOC_FAIL("internal corruption of phar \"%s\" (truncated entry)")
 		}
 
-		if (!test) {
+		if (!test && recursion_count) {
 			test = '\1';
 			pos = buffer+tokenlen;
 			if (!memcmp(pos, gz_magic, 3)) {
@@ -1683,6 +1684,10 @@
 
 				/* now, start over */
 				test = '\0';
+				if (!--recursion_count) {
+					MAPPHAR_ALLOC_FAIL("unable to decompress gzipped phar archive \"%s\"");
+					break;
+				}
 				continue;
 			} else if (!memcmp(pos, bz_magic, 3)) {
 				php_stream_filter *filter;
@@ -1721,6 +1726,10 @@
 
 				/* now, start over */
 				test = '\0';
+				if (!--recursion_count) {
+					MAPPHAR_ALLOC_FAIL("unable to decompress bzipped phar archive \"%s\"");
+					break;
+				}
 				continue;
 			}

php-7.3.33.tar.xz/ext/phar/tests/GHSA-jqcx-ccgc-xwhv.phpt Added

php-7.3.33.tar.xz/ext/phar/tests/bug81726.gz Added

php-7.3.33.tar.xz/ext/phar/tests/bug81726.phpt Added

php-7.3.33.tar.xz/ext/phar/tests/tar/files/circular_symlinks.tar Added

php-7.3.33.tar.xz/ext/phar/tests/tar/files/circular_symlinks_long.tar Added

php-7.3.33.tar.xz/ext/phar/tests/tar/files/circular_symlinks_rho.tar Added

php-7.3.33.tar.xz/ext/phar/tests/tar/ghsa-vc5h-9ppw-p5f3-symlink-circular.phpt Added

php-7.3.33.tar.xz/ext/phar/util.c Changed

@@ -59,30 +59,59 @@
 }
 /* }}} */
 
-phar_entry_info *phar_get_link_source(phar_entry_info *entry) /* {{{ */
+static phar_entry_info *phar_follow_one_link(phar_entry_info *entry)
 {
 	phar_entry_info *link_entry;
 	char *link;
 
-	if (!entry->link) {
-		return entry;
-	}
-
 	link = phar_get_link_location(entry);
 	if (NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), entry->link, strlen(entry->link))) ||
 		NULL != (link_entry = zend_hash_str_find_ptr(&(entry->phar->manifest), link, strlen(link)))) {
 		if (link != entry->link) {
 			efree(link);
 		}
-		return phar_get_link_source(link_entry);
-	} else {
-		if (link != entry->link) {
-			efree(link);
+		return link_entry;
+	}
+
+	if (link != entry->link) {
+		efree(link);
+	}
+	return NULL;
+}
+
+phar_entry_info *phar_get_link_source(phar_entry_info *entry)
+{
+	phar_entry_info *slow, *fast;
+
+	if (!entry->link) {
+		return entry;
+	}
+
+	/*
+	 * Use Floyd's cycle detection algorithm to follow the symlink chain without unbounded
+	 * recursion. Each entry has at most one outgoing link, so if a cycle exists the fast pointer
+	 * will eventually meet the slow one. Otherwise the fast pointer reaches the end first.
+	 */
+	slow = fast = entry;
+	while (1) {
+		fast = phar_follow_one_link(fast);
+		if (!fast || !fast->link) {
+			return fast;
+		}
+		fast = phar_follow_one_link(fast);
+		if (!fast || !fast->link) {
+			return fast;
+		}
+
+		/* no need to check slow as it's always behind */
+		slow = phar_follow_one_link(slow);
+
+		if (slow == fast) {
+			/* circular symlink chain */
+			return NULL;
 		}
-		return NULL;
 	}
 }
-/* }}} */
 
 /* retrieve a phar_entry_info's current file pointer for reading contents */
 php_stream *phar_get_efp(phar_entry_info *entry, int follow_links) /* {{{ */

php-7.3.33.tar.xz/ext/simplexml/simplexml.c Changed

php-7.3.33.tar.xz/ext/simplexml/tests/libxml_global_state_entity_loader_bypass.phpt Added

@@ -0,0 +1,37 @@
+--TEST--
+GHSA-3qrf-m4j2-pcrr (libxml global state entity loader bypass)
+--SKIPIF--
+<?php
+if (!extension_loaded('libxml')) die('skip libxml extension not available');
+if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
+if (!extension_loaded('zend-test')) die('skip zend-test extension not available');
+if (!function_exists('zend_test_override_libxml_global_state')) die('skip not for Windows');
+?>
+--FILE--
+<?php
+
+$xml = "<?xml version='1.0'?><!DOCTYPE root <!ENTITY % bork SYSTEM \"php://nope\"> %bork;><nothing/>";
+
+libxml_use_internal_errors(true);
+zend_test_override_libxml_global_state();
+
+echo "--- String test ---\n";
+simplexml_load_string($xml);
+echo "--- Constructor test ---\n";
+new SimpleXMLElement($xml);
+echo "--- File test ---\n";
+file_put_contents("libxml_global_state_entity_loader_bypass.tmp", $xml);
+simplexml_load_file("libxml_global_state_entity_loader_bypass.tmp");
+
+echo "Done\n";
+
+?>
+--CLEAN--
+<?php
+@unlink("libxml_global_state_entity_loader_bypass.tmp");
+?>
+--EXPECT--
+--- String test ---
+--- Constructor test ---
+--- File test ---
+Done

php-7.3.33.tar.xz/ext/soap/php_encoding.c Changed

php-7.3.33.tar.xz/ext/soap/php_http.c Changed

@@ -22,6 +22,7 @@
 #include "ext/standard/base64.h"
 #include "ext/standard/md5.h"
 #include "ext/standard/php_random.h"
+#include "ext/hash/php_hash.h"
 
 static char *get_http_header_value_nodup(char *headers, char *type, size_t *len);
 static char *get_http_header_value(char *headers, char *type);
@@ -666,18 +667,23 @@
 			if ((digest = zend_hash_str_find(Z_OBJPROP_P(this_ptr), "_digest", sizeof("_digest")-1)) != NULL) {
 				if (Z_TYPE_P(digest) == IS_ARRAY) {
 					char          HA133, HA233, response33, cnonce33, nc9;
-					zend_long     nonce;
+					unsigned char nonce16;
 					PHP_MD5_CTX   md5ctx;
 					unsigned char hash16;
 
-					php_random_bytes_throw(&nonce, sizeof(nonce));
-					nonce &= 0x7fffffff;
+					if (UNEXPECTED(php_random_bytes_throw(&nonce, sizeof(nonce)) != SUCCESS)) {
+						ZEND_ASSERT(EG(exception));
+						php_stream_close(stream);
+						zend_hash_str_del(Z_OBJPROP_P(this_ptr), "httpurl", sizeof("httpurl")-1);
+						zend_hash_str_del(Z_OBJPROP_P(this_ptr), "httpsocket", sizeof("httpsocket")-1);
+						zend_hash_str_del(Z_OBJPROP_P(this_ptr), "_use_proxy", sizeof("_use_proxy")-1);
+						smart_str_free(&soap_headers_z);
+						smart_str_free(&soap_headers);
+						return FALSE;
+					}
 
-					PHP_MD5Init(&md5ctx);
-					snprintf(cnonce, sizeof(cnonce), ZEND_LONG_FMT, nonce);
-					PHP_MD5Update(&md5ctx, (unsigned char*)cnonce, strlen(cnonce));
-					PHP_MD5Final(hash, &md5ctx);
-					make_digest(cnonce, hash);
+					php_hash_bin2hex(cnonce, nonce, sizeof(nonce));
+					cnonce32 = 0;
 
 					if ((tmp = zend_hash_str_find(Z_ARRVAL_P(digest), "nc", sizeof("nc")-1)) != NULL &&
 					    Z_TYPE_P(tmp) == IS_LONG) {

php-7.3.33.tar.xz/ext/soap/php_xml.c Changed

php-7.3.33.tar.xz/ext/soap/soap.c Changed

php-7.3.33.tar.xz/ext/soap/tests/GHSA-85c2-q967-79q5.phpt Added

@@ -0,0 +1,61 @@
+--TEST--
+GHSA-85c2-q967-79q5: Stale SOAP_GLOBAL(ref_map) pointer with Apache Map
+--CREDITS--
+brettgervasoni
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+
+class Handler {
+    public function test(...$args) {
+        $GLOBALS'result' = $args;
+    }
+}
+
+$envelope = <<<'XML'
+<?xml version="1.0" encoding="UTF-8"?>
+<soapenv:Envelope
+    xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+
+    <soapenv:Body>
+        <test>
+            <map xsi:type="apache:Map" xmlns:apache="http://xml.apache.org/xml-soap">
+                <item>
+                    <key>foo</key>
+                    <value id="stale"><object>bar</object></value>
+                </item>
+                <item>
+                    <key>foo</key>
+                    <value>baz</value>
+                </item>
+            </map>
+            <stale href="#stale"/>
+        </test>
+    </soapenv:Body>
+</soapenv:Envelope>
+XML;
+
+$s = new SoapServer(null, 'uri' => 'urn:a');
+$s->setClass(Handler::class);
+$s->handle($envelope);
+var_dump($result);
+
+?>
+--EXPECTF--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="urn:a" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:testResponse><return xsi:nil="true"/></ns1:testResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>
+array(2) {
+  0=>
+  array(1) {
+    "foo"=>
+    string(3) "baz"
+  }
+  1=>
+  object(stdClass)#%d (1) {
+    "object"=>
+    string(3) "bar"
+  }
+}

php-7.3.33.tar.xz/ext/soap/tests/GHSA-hmxp-6pc4-f3vv.phpt Added

@@ -0,0 +1,39 @@
+--TEST--
+GHSA-hmxp-6pc4-f3vv: Null pointer dereference on missing Apache map value
+--CREDITS--
+Ilia Alshanetsky (iliaal)
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+
+$request = <<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope
+    xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+    xmlns:apache="http://xml.apache.org/xml-soap">
+
+    <soap:Body>
+        <test>
+            <map xsi:type="apache:Map">
+                <item><key>hello</key></item>
+            </map>
+        </test>
+    </soap:Body>
+</soap:Envelope>
+XML;
+
+$server = new SoapServer(null, 
+    'uri' => 'urn:test',
+    'typemap' => 'type_name' => 'anything',
+);
+$server->addFunction('test');
+function test($m) { return null; }
+$server->handle($request);
+
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>SOAP-ERROR: Encoding: Can't decode apache map, missing value</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

php-7.3.33.tar.xz/ext/soap/tests/GHSA-m33r-qmcv-p97q.phpt Added

@@ -0,0 +1,58 @@
+--TEST--
+GHSA-m33r-qmcv-p97q: Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION
+--CREDITS--
+Ilia Alshanetsky (iliaal)
+--EXTENSIONS--
+soap
+session
+--FILE--
+<?php
+
+class Handler {
+    public function return()  {
+        return new SoapFault('Server', 'denied');
+    }
+    public function throw()  {
+        throw new SoapFault('Server', 'denied');
+    }
+    public function hello() {
+        return 'ok';
+    }
+}
+
+session_start();
+
+$srv = new SoapServer(null, 'uri' => 'urn:a');
+$srv->setClass(Handler::class);
+$srv->setPersistence(SOAP_PERSISTENCE_SESSION);
+
+$srv->handle(<<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="urn:a">
+    <soap:Header>
+        <a:return/>
+    </soap:Header>
+    <soap:Body>
+        <a:hello/>
+    </soap:Body>
+</soap:Envelope>
+XML);
+
+$srv->handle(<<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:a="urn:a">
+    <soap:Header>
+        <a:throw/>
+    </soap:Header>
+    <soap:Body>
+        <a:hello/>
+    </soap:Body>
+</soap:Envelope>
+XML);
+
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring>denied</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

php-7.3.33.tar.xz/ext/standard/array.c Changed

php-7.3.33.tar.xz/ext/standard/crypt.c Changed

php-7.3.33.tar.xz/ext/standard/crypt_blowfish.c Changed

php-7.3.33.tar.xz/ext/standard/filters.c Changed

php-7.3.33.tar.xz/ext/standard/http_fopen_wrapper.c Changed

@@ -187,6 +187,11 @@
 			return NULL;
 		}
 
+		/* Should we send the entire path in the request line, default to no. */
+		if (context && (tmpzval = php_stream_context_get_option(context, "http", "request_fulluri")) != NULL) {
+			request_fulluri = zend_is_true(tmpzval);
+		}
+
 		use_ssl = resource->scheme && (ZSTR_LEN(resource->scheme) > 4) && ZSTR_VAL(resource->scheme)4 == 's';
 		/* choose default ports */
 		if (use_ssl && resource->port == 0)
@@ -206,6 +211,13 @@
 		}
 	}
 
+	if (request_fulluri && (strchr(path, '\n') != NULL || strchr(path, '\r') != NULL)) {
+		php_stream_wrapper_log_error(wrapper, options, "HTTP wrapper full URI path does not allow CR or LF characters");
+		php_url_free(resource);
+		efree(transport_string);
+		return NULL;
+	}
+
 	if (context && (tmpzval = php_stream_context_get_option(context, wrapper->wops->label, "timeout")) != NULL) {
 		double d = zval_get_double(tmpzval);
 #ifndef PHP_WIN32
@@ -386,12 +398,6 @@
 		smart_str_appends(&req_buf, "GET ");
 	}
 
-	/* Should we send the entire path in the request line, default to no. */
-	if (!request_fulluri && context &&
-		(tmpzval = php_stream_context_get_option(context, "http", "request_fulluri")) != NULL) {
-		request_fulluri = zend_is_true(tmpzval);
-	}
-
 	if (request_fulluri) {
 		/* Ask for everything */
 		smart_str_appends(&req_buf, path);

php-7.3.33.tar.xz/ext/standard/metaphone.c Changed

php-7.3.33.tar.xz/ext/standard/password.c Changed

php-7.3.33.tar.xz/ext/standard/tests/GHSA-96wq-48vp-hh57.phpt Added

php-7.3.33.tar.xz/ext/standard/tests/array/GHSA-h96m-rvf9-jgm2.phpt Added

php-7.3.33.tar.xz/ext/standard/tests/bug81727.phpt Added

php-7.3.33.tar.xz/ext/standard/tests/crypt/bcrypt_salt_dollar.phpt Added

@@ -0,0 +1,82 @@
+--TEST--
+bcrypt correctly rejects salts containing $
+--FILE--
+<?php
+for ($i = 0; $i < 23; $i++) {
+	$salt = '$2y$04$' . str_repeat('0', $i) . '$';
+	$result = crypt("foo", $salt);
+	var_dump($salt);
+	var_dump($result);
+	var_dump($result === $salt);
+}
+?>
+--EXPECT--
+string(8) "$2y$04$$"
+string(2) "*0"
+bool(false)
+string(9) "$2y$04$0$"
+string(2) "*0"
+bool(false)
+string(10) "$2y$04$00$"
+string(2) "*0"
+bool(false)
+string(11) "$2y$04$000$"
+string(2) "*0"
+bool(false)
+string(12) "$2y$04$0000$"
+string(2) "*0"
+bool(false)
+string(13) "$2y$04$00000$"
+string(2) "*0"
+bool(false)
+string(14) "$2y$04$000000$"
+string(2) "*0"
+bool(false)
+string(15) "$2y$04$0000000$"
+string(2) "*0"
+bool(false)
+string(16) "$2y$04$00000000$"
+string(2) "*0"
+bool(false)
+string(17) "$2y$04$000000000$"
+string(2) "*0"
+bool(false)
+string(18) "$2y$04$0000000000$"
+string(2) "*0"
+bool(false)
+string(19) "$2y$04$00000000000$"
+string(2) "*0"
+bool(false)
+string(20) "$2y$04$000000000000$"
+string(2) "*0"
+bool(false)
+string(21) "$2y$04$0000000000000$"
+string(2) "*0"
+bool(false)
+string(22) "$2y$04$00000000000000$"
+string(2) "*0"
+bool(false)
+string(23) "$2y$04$000000000000000$"
+string(2) "*0"
+bool(false)
+string(24) "$2y$04$0000000000000000$"
+string(2) "*0"
+bool(false)
+string(25) "$2y$04$00000000000000000$"
+string(2) "*0"
+bool(false)
+string(26) "$2y$04$000000000000000000$"
+string(2) "*0"
+bool(false)
+string(27) "$2y$04$0000000000000000000$"
+string(2) "*0"
+bool(false)
+string(28) "$2y$04$00000000000000000000$"
+string(2) "*0"
+bool(false)
+string(29) "$2y$04$000000000000000000000$"
+string(2) "*0"
+bool(false)
+string(30) "$2y$04$0000000000000000000000$"
+string(60) "$2y$04$000000000000000000000u2a2UpVexIt9k3FMJeAVr3c04F5tcI8K"
+bool(false)

php-7.3.33.tar.xz/ext/standard/tests/filters/ghsa-r977-prxv-hc43.phpt Added

@@ -0,0 +1,12 @@
+--TEST--
+GHSA-r977-prxv-hc43: Single byte overread with convert.quoted-printable-decode filter
+--FILE--
+<?php
+
+$input_data = str_repeat('A', 8189)."X=\r";
+$filter_url = "php://filter/convert.quoted-printable-decode/resource=data:," . urlencode($input_data);
+var_dump(file_get_contents($filter_url));
+
+?>
+--EXPECT--
+string(8190) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX"

php-7.3.33.tar.xz/ext/standard/tests/ghsa-wpj3-hf5j-x4v4.phpt Added

@@ -0,0 +1,63 @@
+--TEST--
+ghsa-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix)
+--COOKIE--
+..Host-test=ignore_1;
+._Host-test=ignore_2;
+.Host-test=ignore_3;
+_.Host-test=ignore_4;
+__Host-test=ignore_5;
+_Host-test=ignore_6;
+.Host-test=ignore_7;
+_Host-test=ignore_8;
+Host-test=ignore_9;
+..Host-test=ignore_10;
+._Host-test=ignore_11;
+.Host-test=ignore_12;
+_.Host-test=ignore_13;
+__Host-test=legitimate_14;
+_Host-test=legitimate_15;
+.Host-test=ignore_16;
+_Host-test=ignore_17;
+Host-test=ignore_18;
+..Secure-test=ignore_1;
+._Secure-test=ignore_2;
+.Secure-test=ignore_3;
+_.Secure-test=ignore_4;
+__Secure-test=ignore_5;
+_Secure-test=ignore_6;
+.Secure-test=ignore_7;
+_Secure-test=ignore_8;
+Secure-test=ignore_9;
+..Secure-test=ignore_10;
+._Secure-test=ignore_11;
+.Secure-test=ignore_12;
+_.Secure-test=ignore_13;
+__Secure-test=legitimate_14;
+_Secure-test=legitimate_15;
+.Secure-test=ignore_16;
+_Secure-test=ignore_17;
+Secure-test=ignore_18;
+--FILE--
+<?php
+var_dump($_COOKIE);
+?>
+--EXPECT--
+array(3) {
+  "__Host-test"=>
+  array(1) {
+    0=>
+    string(13) "legitimate_14"
+  }
+  "_"=>
+  array(2) {
+    "Host-test"=>
+    string(13) "legitimate_15"
+    "Secure-test"=>
+    string(13) "legitimate_15"
+  }
+  "__Secure-test"=>
+  array(1) {
+    0=>
+    string(13) "legitimate_14"
+  }
+}

php-7.3.33.tar.xz/ext/standard/tests/http/ghsa-c5f2-jwm7-mmq2.phpt Added

php-7.3.33.tar.xz/ext/standard/tests/password/password_bcrypt_errors.phpt Changed

php-7.3.33.tar.xz/ext/standard/tests/password/password_bcrypt_short.phpt Added

php-7.3.33.tar.xz/ext/standard/url_scanner_ex.c Changed

@@ -1,4 +1,5 @@
 /* Generated by re2c 1.0.3 */
+#line 1 "ext/standard/url_scanner_ex.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
@@ -171,6 +172,7 @@
 	STD_PHP_INI_ENTRY("url_rewriter.hosts", "", PHP_INI_ALL, OnUpdateOutputHosts, url_adapt_session_hosts_ht, php_basic_globals, basic_globals)
 PHP_INI_END()
 
+#line 179 "ext/standard/url_scanner_ex.re"
 
 
 #define YYFILL(n) goto done
@@ -518,6 +520,7 @@
 state_plain:
 	start = YYCURSOR;
 
+#line 524 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -567,16 +570,22 @@
 	if (yybm0+yych & 128) {
 		goto yy2;
 	}
+#line 527 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_plain; }
+#line 576 "ext/standard/url_scanner_ex.c"
 yy5:
 	++YYCURSOR;
+#line 526 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); STATE = STATE_TAG; goto state_tag; }
+#line 581 "ext/standard/url_scanner_ex.c"
 }
+#line 528 "ext/standard/url_scanner_ex.re"
 
 
 state_tag:
 	start = YYCURSOR;
 
+#line 589 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -619,7 +628,9 @@
 		goto yy11;
 	}
 	++YYCURSOR;
+#line 534 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_plain_begin; }
+#line 634 "ext/standard/url_scanner_ex.c"
 yy11:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -627,8 +638,11 @@
 	if (yybm0+yych & 128) {
 		goto yy11;
 	}
+#line 533 "ext/standard/url_scanner_ex.re"
 	{ handle_tag(STD_ARGS); /* Sets STATE */; passthru(STD_ARGS); if (STATE == STATE_PLAIN) goto state_plain; else goto state_next_arg; }
+#line 644 "ext/standard/url_scanner_ex.c"
 }
+#line 535 "ext/standard/url_scanner_ex.re"
 
 
 state_next_arg_begin:
@@ -637,6 +651,7 @@
 state_next_arg:
 	start = YYCURSOR;
 
+#line 655 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -692,7 +707,9 @@
 yy16:
 	++YYCURSOR;
 yy17:
+#line 546 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_plain_begin; }
+#line 713 "ext/standard/url_scanner_ex.c"
 yy18:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -700,22 +717,30 @@
 	if (yybm0+yych & 128) {
 		goto yy18;
 	}
+#line 544 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_next_arg; }
+#line 723 "ext/standard/url_scanner_ex.c"
 yy21:
 	yych = *++YYCURSOR;
 	if (yych != '>') goto yy17;
 yy22:
 	++YYCURSOR;
+#line 543 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); handle_form(STD_ARGS); goto state_plain_begin; }
+#line 731 "ext/standard/url_scanner_ex.c"
 yy24:
 	++YYCURSOR;
+#line 545 "ext/standard/url_scanner_ex.re"
 	{ --YYCURSOR; STATE = STATE_ARG; goto state_arg; }
+#line 736 "ext/standard/url_scanner_ex.c"
 }
+#line 547 "ext/standard/url_scanner_ex.re"
 
 
 state_arg:
 	start = YYCURSOR;
 
+#line 744 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -760,7 +785,9 @@
 	if (yych <= 'z') goto yy30;
 yy28:
 	++YYCURSOR;
+#line 553 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); STATE = STATE_NEXT_ARG; goto state_next_arg; }
+#line 791 "ext/standard/url_scanner_ex.c"
 yy30:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -768,13 +795,17 @@
 	if (yybm0+yych & 128) {
 		goto yy30;
 	}
+#line 552 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); handle_arg(STD_ARGS); STATE = STATE_BEFORE_VAL; goto state_before_val; }
+#line 801 "ext/standard/url_scanner_ex.c"
 }
+#line 554 "ext/standard/url_scanner_ex.re"
 
 
 state_before_val:
 	start = YYCURSOR;
 
+#line 809 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -817,7 +848,9 @@
 	if (yych == '=') goto yy38;
 	++YYCURSOR;
 yy36:
+#line 560 "ext/standard/url_scanner_ex.re"
 	{ --YYCURSOR; goto state_next_arg_begin; }
+#line 854 "ext/standard/url_scanner_ex.c"
 yy37:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ' ') goto yy41;
@@ -829,7 +862,9 @@
 	if (yybm0+yych & 128) {
 		goto yy38;
 	}
+#line 559 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); STATE = STATE_VAL; goto state_val; }
+#line 868 "ext/standard/url_scanner_ex.c"
 yy41:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -839,12 +874,14 @@
 	YYCURSOR = YYMARKER;
 	goto yy36;
 }
+#line 561 "ext/standard/url_scanner_ex.re"
 
 
 
 state_val:
 	start = YYCURSOR;
 
+#line 885 "ext/standard/url_scanner_ex.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -897,11 +934,15 @@
 	if (yybm0+yych & 32) {
 		goto yy46;
 	}
+#line 569 "ext/standard/url_scanner_ex.re"
 	{ handle_val(STD_ARGS, 0, ' '); goto state_next_arg_begin; }
+#line 940 "ext/standard/url_scanner_ex.c"
 yy49:
 	++YYCURSOR;
 yy50:
+#line 570 "ext/standard/url_scanner_ex.re"
 	{ passthru(STD_ARGS); goto state_next_arg_begin; }
+#line 946 "ext/standard/url_scanner_ex.c"
 yy51:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == '>') goto yy50;
@@ -924,7 +965,9 @@
 	goto yy50;
 yy56:
 	++YYCURSOR;
+#line 567 "ext/standard/url_scanner_ex.re"

php-7.3.33.tar.xz/ext/standard/var_unserializer.c Changed

@@ -1,4 +1,5 @@
 /* Generated by re2c 1.0.1 */
+#line 1 "ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 7                                                        |
@@ -314,6 +315,7 @@
 #define YYMARKER marker
 
 
+#line 323 "ext/standard/var_unserializer.re"
 
 
 
@@ -671,6 +673,7 @@
 	start = cursor;
 
 
+#line 677 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm = {
@@ -728,7 +731,9 @@
 yy2:
 	++YYCURSOR;
 yy3:
+#line 1076 "ext/standard/var_unserializer.re"
 	{ return 0; }
+#line 737 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy17;
@@ -775,11 +780,13 @@
 	goto yy3;
 yy15:
 	++YYCURSOR;
+#line 1070 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
+#line 790 "ext/standard/var_unserializer.c"
 yy17:
 	yych = *++YYCURSOR;
 	if (yybm0+yych & 128) {
@@ -790,11 +797,13 @@
 	goto yy3;
 yy19:
 	++YYCURSOR;
+#line 731 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	ZVAL_NULL(rval);
 	return 1;
 }
+#line 807 "ext/standard/var_unserializer.c"
 yy21:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -998,6 +1007,7 @@
 	goto yy18;
 yy57:
 	++YYCURSOR;
+#line 681 "ext/standard/var_unserializer.re"
 	{
 	zend_long id;
 
@@ -1022,6 +1032,7 @@
 
 	return 1;
 }
+#line 1036 "ext/standard/var_unserializer.c"
 yy59:
 	yych = *++YYCURSOR;
 	if (yych == '"') goto yy80;
@@ -1032,18 +1043,22 @@
 	goto yy18;
 yy61:
 	++YYCURSOR;
+#line 737 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	ZVAL_FALSE(rval);
 	return 1;
 }
+#line 1053 "ext/standard/var_unserializer.c"
 yy63:
 	++YYCURSOR;
+#line 743 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	ZVAL_TRUE(rval);
 	return 1;
 }
+#line 1062 "ext/standard/var_unserializer.c"
 yy65:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
@@ -1063,6 +1078,7 @@
 	}
 yy67:
 	++YYCURSOR;
+#line 791 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_ZEND_LONG == 4
 use_double:
@@ -1071,6 +1087,7 @@
 	ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
+#line 1091 "ext/standard/var_unserializer.c"
 yy69:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1092,6 +1109,7 @@
 	goto yy18;
 yy72:
 	++YYCURSOR;
+#line 749 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_ZEND_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1117,12 +1135,14 @@
 	ZVAL_LONG(rval, parse_iv(start + 2));
 	return 1;
 }
+#line 1139 "ext/standard/var_unserializer.c"
 yy74:
 	yych = *++YYCURSOR;
 	if (yych == '"') goto yy88;
 	goto yy18;
 yy75:
 	++YYCURSOR;
+#line 706 "ext/standard/var_unserializer.re"
 	{
 	zend_long id;
 
@@ -1147,12 +1167,14 @@
 
 	return 1;
 }
+#line 1171 "ext/standard/var_unserializer.c"
 yy77:
 	yych = *++YYCURSOR;
 	if (yych == '"') goto yy90;
 	goto yy18;
 yy78:
 	++YYCURSOR;
+#line 918 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	zend_long elements;
@@ -1304,8 +1326,10 @@
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
+#line 1330 "ext/standard/var_unserializer.c"
 yy80:
 	++YYCURSOR;
+#line 840 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	zend_string *str;
@@ -1339,8 +1363,10 @@
 	ZVAL_STR(rval, str);
 	return 1;
 }
+#line 1367 "ext/standard/var_unserializer.c"
 yy82:
 	++YYCURSOR;
+#line 874 "ext/standard/var_unserializer.re"
 	{
 	zend_long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -1373,6 +1399,7 @@
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
+#line 1403 "ext/standard/var_unserializer.c"
 yy84:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1391,6 +1418,7 @@
 	goto yy18;
 yy88:
 	++YYCURSOR;
+#line 907 "ext/standard/var_unserializer.re"
 	{
 	zend_long elements;
     if (!var_hash) return 0;
@@ -1401,8 +1429,10 @@
 	}
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
+#line 1433 "ext/standard/var_unserializer.c"
 yy90:
 	++YYCURSOR;
+#line 800 "ext/standard/var_unserializer.re"
 	{

php-7.3.33.tar.xz/ext/xml/compat.c Changed

php-7.3.33.tar.xz/ext/xmlreader/php_xmlreader.c Changed

@@ -290,6 +290,7 @@
 		return NULL;
 	}
 
+	PHP_LIBXML_SANITIZE_GLOBALS(parse);
 	if (error_func || warn_func) {
 		xmlRelaxNGSetParserErrors(parser,
 			(xmlRelaxNGValidityErrorFunc) error_func,
@@ -298,6 +299,7 @@
 	}
 	sptr = xmlRelaxNGParse(parser);
 	xmlRelaxNGFreeParserCtxt(parser);
+	PHP_LIBXML_RESTORE_GLOBALS(parse);
 
 	return sptr;
 }
@@ -870,7 +872,9 @@
 	valid_file = _xmlreader_get_valid_file_path(source, resolved_path, MAXPATHLEN );
 
 	if (valid_file) {
+		PHP_LIBXML_SANITIZE_GLOBALS(reader_for_file);
 		reader = xmlReaderForFile(valid_file, encoding, options);
+		PHP_LIBXML_RESTORE_GLOBALS(reader_for_file);
 	}
 
 	if (reader == NULL) {
@@ -948,7 +952,9 @@
 
 	intern = Z_XMLREADER_P(id);
 	if (intern && intern->ptr) {
+		PHP_LIBXML_SANITIZE_GLOBALS(schema);
 		retval = xmlTextReaderSchemaValidate(intern->ptr, source);
+		PHP_LIBXML_RESTORE_GLOBALS(schema);
 
 		if (retval == 0) {
 			RETURN_TRUE;
@@ -1029,7 +1035,7 @@
 	xmlreader_object *intern = NULL;
 	char *source, *uri = NULL, *encoding = NULL;
 	int resolved_path_len, ret = 0;
-	char *directory=NULL, resolved_pathMAXPATHLEN;
+	char *directory=NULL, resolved_pathMAXPATHLEN + 1;
 	xmlParserInputBufferPtr inputbfr;
 	xmlTextReaderPtr reader;
 
@@ -1068,6 +1074,7 @@
 			}
 			uri = (char *) xmlCanonicPath((const xmlChar *) resolved_path);
 		}
+		PHP_LIBXML_SANITIZE_GLOBALS(text_reader);
 		reader = xmlNewTextReader(inputbfr, uri);
 
 		if (reader != NULL) {
@@ -1088,9 +1095,11 @@
 					xmlFree(uri);
 				}
 
+				PHP_LIBXML_RESTORE_GLOBALS(text_reader);
 				return;
 			}
 		}
+		PHP_LIBXML_RESTORE_GLOBALS(text_reader);
 	}
 
 	if (uri) {

php-7.3.33.tar.xz/ext/xmlreader/tests/libxml_global_state_entity_loader_bypass.phpt Added

@@ -0,0 +1,36 @@
+--TEST--
+GHSA-3qrf-m4j2-pcrr (libxml global state entity loader bypass)
+--SKIPIF--
+<?php
+if (!extension_loaded('libxml')) die('skip libxml extension not available');
+if (!extension_loaded('xmlreader')) die('skip xmlreader extension not available');
+if (!extension_loaded('zend-test')) die('skip zend-test extension not available');
+if (!function_exists('zend_test_override_libxml_global_state')) die('skip not for Windows');
+?>
+--FILE--
+<?php
+
+$xml = "<?xml version='1.0'?><!DOCTYPE root <!ENTITY % bork SYSTEM \"php://nope\"> %bork;><nothing/>";
+
+libxml_use_internal_errors(true);
+zend_test_override_libxml_global_state();
+
+echo "--- String test ---\n";
+$reader = @XMLReader::xml($xml);
+$reader->read();
+echo "--- File test ---\n";
+file_put_contents("libxml_global_state_entity_loader_bypass.tmp", $xml);
+$reader = @XMLReader::open("libxml_global_state_entity_loader_bypass.tmp");
+$reader->read();
+
+echo "Done\n";
+
+?>
+--CLEAN--
+<?php
+@unlink("libxml_global_state_entity_loader_bypass.tmp");
+?>
+--EXPECT--
+--- String test ---
+--- File test ---
+Done

php-7.3.33.tar.xz/ext/xsl/xsltprocessor.c Changed

php-7.3.33.tar.xz/ext/zend_test/test.c Changed

@@ -25,6 +25,11 @@
 #include "ext/standard/info.h"
 #include "php_test.h"
 
+#if defined(HAVE_LIBXML) && !defined(PHP_WIN32)
+# include <libxml/globals.h>
+# include <libxml/parser.h>
+#endif
+
 static zend_class_entry *zend_test_interface;
 static zend_class_entry *zend_test_class;
 static zend_class_entry *zend_test_child_class;
@@ -48,6 +53,20 @@
 	ZEND_ARG_INFO(0, variable)
 ZEND_END_ARG_INFO()
 
+#if defined(HAVE_LIBXML) && !defined(PHP_WIN32)
+static ZEND_FUNCTION(zend_test_override_libxml_global_state)
+{
+	ZEND_PARSE_PARAMETERS_NONE();
+
+	xmlLoadExtDtdDefaultValue = 1;
+	xmlDoValidityCheckingDefaultValue = 1;
+	(void) xmlPedanticParserDefault(1);
+	(void) xmlSubstituteEntitiesDefault(1);
+	(void) xmlLineNumbersDefault(1);
+	(void) xmlKeepBlanksDefault(0);
+}
+#endif
+
 ZEND_FUNCTION(zend_test_func)
 {
 	/* dummy */
@@ -266,6 +285,9 @@
 	ZEND_FE(zend_terminate_string, arginfo_zend_terminate_string)
 	ZEND_FE(zend_leak_bytes, NULL)
 	ZEND_FE(zend_leak_variable, arginfo_zend_leak_variable)
+#if defined(HAVE_LIBXML) && !defined(PHP_WIN32)
+	ZEND_FE(zend_test_override_libxml_global_state, NULL)
+#endif
 	ZEND_FE_END
 };

php-7.3.33.tar.xz/main/fopen_wrappers.c Changed

php-7.3.33.tar.xz/main/main.c Changed

php-7.3.33.tar.xz/main/php_config.h.in Deleted

@@ -1,2664 +0,0 @@
-/* main/php_config.h.in.  Generated from configure.ac by autoheader.  */
-
-
-#ifndef PHP_CONFIG_H
-#define PHP_CONFIG_H
-
-#if defined(__GNUC__) && __GNUC__ >= 4
-# define ZEND_API __attribute__ ((visibility("default")))
-# define ZEND_DLEXPORT __attribute__ ((visibility("default")))
-#else
-# define ZEND_API
-# define ZEND_DLEXPORT
-#endif
-
-#define ZEND_DLIMPORT
-
-#undef uint
-#undef ulong
-
-
-/* */
-#undef CDB_INCLUDE_FILE
-
-/* Define if system uses EBCDIC */
-#undef CHARSET_EBCDIC
-
-/* Whether to build bcmath as dynamic module */
-#undef COMPILE_DL_BCMATH
-
-/* Whether to build bz2 as dynamic module */
-#undef COMPILE_DL_BZ2
-
-/* Whether to build calendar as dynamic module */
-#undef COMPILE_DL_CALENDAR
-
-/* Whether to build ctype as dynamic module */
-#undef COMPILE_DL_CTYPE
-
-/* Whether to build curl as dynamic module */
-#undef COMPILE_DL_CURL
-
-/* Whether to build date as dynamic module */
-#undef COMPILE_DL_DATE
-
-/* Whether to build dba as dynamic module */
-#undef COMPILE_DL_DBA
-
-/* Whether to build dom as dynamic module */
-#undef COMPILE_DL_DOM
-
-/* Whether to build enchant as dynamic module */
-#undef COMPILE_DL_ENCHANT
-
-/* Whether to build exif as dynamic module */
-#undef COMPILE_DL_EXIF
-
-/* Whether to build fileinfo as dynamic module */
-#undef COMPILE_DL_FILEINFO
-
-/* Whether to build filter as dynamic module */
-#undef COMPILE_DL_FILTER
-
-/* Whether to build ftp as dynamic module */
-#undef COMPILE_DL_FTP
-
-/* Whether to build gd as dynamic module */
-#undef COMPILE_DL_GD
-
-/* Whether to build gettext as dynamic module */
-#undef COMPILE_DL_GETTEXT
-
-/* Whether to build gmp as dynamic module */
-#undef COMPILE_DL_GMP
-
-/* Whether to build hash as dynamic module */
-#undef COMPILE_DL_HASH
-
-/* Whether to build iconv as dynamic module */
-#undef COMPILE_DL_ICONV
-
-/* Whether to build imap as dynamic module */
-#undef COMPILE_DL_IMAP
-
-/* Whether to build interbase as dynamic module */
-#undef COMPILE_DL_INTERBASE
-
-/* Whether to build intl as dynamic module */
-#undef COMPILE_DL_INTL
-
-/* Whether to build json as dynamic module */
-#undef COMPILE_DL_JSON
-
-/* Whether to build ldap as dynamic module */
-#undef COMPILE_DL_LDAP
-
-/* Whether to build libxml as dynamic module */
-#undef COMPILE_DL_LIBXML
-
-/* Whether to build mbstring as dynamic module */
-#undef COMPILE_DL_MBSTRING
-
-/* Whether to build mysqli as dynamic module */
-#undef COMPILE_DL_MYSQLI
-
-/* Whether to build mysqlnd as dynamic module */
-#undef COMPILE_DL_MYSQLND
-
-/* Whether to build oci8 as dynamic module */
-#undef COMPILE_DL_OCI8
-
-/* Whether to build odbc as dynamic module */
-#undef COMPILE_DL_ODBC
-
-/* Whether to build opcache as dynamic module */
-#undef COMPILE_DL_OPCACHE
-
-/* Whether to build openssl as dynamic module */
-#undef COMPILE_DL_OPENSSL
-
-/* Whether to build pcntl as dynamic module */
-#undef COMPILE_DL_PCNTL
-
-/* Whether to build pcre as dynamic module */
-#undef COMPILE_DL_PCRE
-
-/* Whether to build pdo as dynamic module */
-#undef COMPILE_DL_PDO
-
-/* Whether to build pdo_dblib as dynamic module */
-#undef COMPILE_DL_PDO_DBLIB
-
-/* Whether to build pdo_firebird as dynamic module */
-#undef COMPILE_DL_PDO_FIREBIRD
-
-/* Whether to build pdo_mysql as dynamic module */
-#undef COMPILE_DL_PDO_MYSQL
-
-/* Whether to build pdo_oci as dynamic module */
-#undef COMPILE_DL_PDO_OCI
-
-/* Whether to build pdo_odbc as dynamic module */
-#undef COMPILE_DL_PDO_ODBC
-
-/* Whether to build pdo_pgsql as dynamic module */
-#undef COMPILE_DL_PDO_PGSQL
-
-/* Whether to build pdo_sqlite as dynamic module */
-#undef COMPILE_DL_PDO_SQLITE
-
-/* Whether to build pgsql as dynamic module */
-#undef COMPILE_DL_PGSQL
-
-/* Whether to build phar as dynamic module */
-#undef COMPILE_DL_PHAR
-
-/* Whether to build phpdbg_webhelper as dynamic module */
-#undef COMPILE_DL_PHPDBG_WEBHELPER
-
-/* Whether to build posix as dynamic module */
-#undef COMPILE_DL_POSIX
-
-/* Whether to build pspell as dynamic module */
-#undef COMPILE_DL_PSPELL
-
-/* Whether to build readline as dynamic module */
-#undef COMPILE_DL_READLINE
-
-/* Whether to build recode as dynamic module */
-#undef COMPILE_DL_RECODE
-
-/* Whether to build reflection as dynamic module */
-#undef COMPILE_DL_REFLECTION
-
-/* Whether to build session as dynamic module */
-#undef COMPILE_DL_SESSION
-
-/* Whether to build shmop as dynamic module */
-#undef COMPILE_DL_SHMOP
-
-/* Whether to build simplexml as dynamic module */
-#undef COMPILE_DL_SIMPLEXML
-
-/* Whether to build snmp as dynamic module */
-#undef COMPILE_DL_SNMP
-
-/* Whether to build soap as dynamic module */
-#undef COMPILE_DL_SOAP
-
-/* Whether to build sockets as dynamic module */
-#undef COMPILE_DL_SOCKETS
-
-/* Whether to build sodium as dynamic module */
-#undef COMPILE_DL_SODIUM
-
-/* Whether to build spl as dynamic module */
-#undef COMPILE_DL_SPL
-
-/* Whether to build sqlite3 as dynamic module */
-#undef COMPILE_DL_SQLITE3

php-7.3.33.tar.xz/main/php_variables.c Changed

@@ -65,6 +65,21 @@
 	zend_string_release_ex(key, 0);
 }
 
+/* Discard variable if mangling made it start with __Host-, where pre-mangling it did not start with __Host-
+ * Discard variable if mangling made it start with __Secure-, where pre-mangling it did not start with __Secure- */
+static zend_bool php_is_forbidden_variable_name(const char *mangled_name, size_t mangled_name_len, const char *pre_mangled_name)
+{
+	if (mangled_name_len >= sizeof("__Host-")-1 && strncmp(mangled_name, "__Host-", sizeof("__Host-")-1) == 0 && strncmp(pre_mangled_name, "__Host-", sizeof("__Host-")-1) != 0) {
+		return 1;
+	}
+
+	if (mangled_name_len >= sizeof("__Secure-")-1 && strncmp(mangled_name, "__Secure-", sizeof("__Secure-")-1) == 0 && strncmp(pre_mangled_name, "__Secure-", sizeof("__Secure-")-1) != 0) {
+		return 1;
+	}
+
+	return 0;
+}
+
 PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars_array)
 {
 	char *p = NULL;
@@ -212,6 +227,12 @@
 					return;
 				}
 			} else {
+				if (php_is_forbidden_variable_name(index, index_len, var_name)) {
+					zval_ptr_dtor_nogc(val);
+					free_alloca(var_orig, use_heap);
+					return;
+				}
+
 				gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
 				if (!gpc_element_p) {
 					zval tmp;
@@ -249,6 +270,12 @@
 				zval_ptr_dtor_nogc(val);
 			}
 		} else {
+			if (php_is_forbidden_variable_name(index, index_len, var_name)) {
+				zval_ptr_dtor_nogc(val);
+				free_alloca(var_orig, use_heap);
+				return;
+			}
+
 			zend_ulong idx;
 
 			/*

php-7.3.33.tar.xz/main/rfc1867.c Changed

@@ -702,6 +702,7 @@
 	void *event_extra_data = NULL;
 	unsigned int llen = 0;
 	int upload_cnt = INI_INT("max_file_uploads");
+	int body_parts_cnt = INI_INT("max_multipart_body_parts");
 	const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding();
 	php_rfc1867_getword_t getword;
 	php_rfc1867_getword_conf_t getword_conf;
@@ -723,6 +724,11 @@
 		return;
 	}
 
+	if (body_parts_cnt < 0) {
+		body_parts_cnt = PG(max_input_vars) + upload_cnt;
+	}
+	int body_parts_limit = body_parts_cnt;
+
 	/* Get the boundary */
 	boundary = strstr(content_type_dup, "boundary");
 	if (!boundary) {
@@ -761,6 +767,13 @@
 		boundary_len = boundary_end-boundary;
 	}
 
+	/* Boundaries larger than FILLUNIT-strlen("\r\n--") characters lead to
+	 * erroneous parsing */
+	if (boundary_len > FILLUNIT-strlen("\r\n--")) {
+		sapi_module.sapi_error(E_WARNING, "Boundary too large in multipart/form-data POST data");
+		return;
+	}
+
 	/* Initialize the buffer */
 	if (!(mbuff = multipart_buffer_new(boundary, boundary_len))) {
 		sapi_module.sapi_error(E_WARNING, "Unable to initialize the input buffer");
@@ -807,6 +820,11 @@
 			char *pair = NULL;
 			int end = 0;
 
+			if (--body_parts_cnt < 0) {
+				php_error_docref(NULL, E_WARNING, "Multipart body parts limit exceeded %d. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit);
+				goto fileupload_done;
+			}
+
 			while (isspace(*cd)) {
 				++cd;
 			}
@@ -930,7 +948,10 @@
 				skip_upload = 1;
 			} else if (upload_cnt <= 0) {
 				skip_upload = 1;
-				sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
+				if (upload_cnt == 0) {
+					--upload_cnt;
+					sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
+				}
 			}
 
 			/* Return with an error if the posted data is garbled */

php-7.3.33.tar.xz/sapi/cgi/cgi_main.c Changed

@@ -1784,7 +1784,6 @@
 	int status = 0;
 #endif
 	char *query_string;
-	char *decoded_query_string;
 	int skip_getopt = 0;
 
 #ifdef HAVE_SIGNAL_H
@@ -1835,10 +1834,20 @@
 		}
 	}
 
+	/* Apache CGI will pass the query string to the command line if it doesn't contain a '='.
+	 * This can create an issue where a malicious request can pass command line arguments to
+	 * the executable. Ideally we skip argument parsing when we're in cgi or fastcgi mode,
+	 * but that breaks PHP scripts on Linux with a hashbang: `#!/php-cgi -d option=value`.
+	 * Therefore, this code only prevents passing arguments if the query string starts with a '-'.
+	 * Similarly, scripts spawned in subprocesses on Windows may have the same issue.
+	 * However, Windows has lots of conversion rules and command line parsing rules that
+	 * are too difficult and dangerous to reliably emulate. */
 	if((query_string = getenv("QUERY_STRING")) != NULL && strchr(query_string, '=') == NULL) {
-		/* we've got query string that has no = - apache CGI will pass it to command line */
+#ifdef PHP_WIN32
+		skip_getopt = cgi || fastcgi;
+#else
 		unsigned char *p;
-		decoded_query_string = strdup(query_string);
+		char *decoded_query_string = strdup(query_string);
 		php_url_decode(decoded_query_string, strlen(decoded_query_string));
 		for (p = (unsigned char *)decoded_query_string; *p &&  *p <= ' '; p++) {
 			/* skip all leading spaces */
@@ -1846,7 +1855,9 @@
 		if(*p == '-') {
 			skip_getopt = 1;
 		}
+
 		free(decoded_query_string);
+#endif
 	}
 
 	while (!skip_getopt && (c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) {
@@ -1935,18 +1946,17 @@
 
 	/* check force_cgi after startup, so we have proper output */
 	if (cgi && CGIG(force_redirect)) {
-		/* Apache will generate REDIRECT_STATUS,
-		 * Netscape and redirect.so will generate HTTP_REDIRECT_STATUS.
-		 * redirect.so and installation instructions available from
-		 * http://www.koehntopp.de/php.
-		 *   -- kk@netuse.de
-		 */
-		if (!getenv("REDIRECT_STATUS") &&
-			!getenv ("HTTP_REDIRECT_STATUS") &&
-			/* this is to allow a different env var to be configured
-			 * in case some server does something different than above */
-			(!CGIG(redirect_status_env) || !getenv(CGIG(redirect_status_env)))
-		) {
+		/* This is to allow a different environment variable to be configured
+		 * in case the we cannot auto-detect which environment variable to use.
+		 * Checking this first to allow user overrides in case the environment
+		 * variable can be set by an untrusted party. */
+		const char *redirect_status_env = CGIG(redirect_status_env);
+		if (!redirect_status_env) {
+			/* Apache will generate REDIRECT_STATUS. */
+			redirect_status_env = "REDIRECT_STATUS";
+		}
+
+		if (!getenv(redirect_status_env)) {
 			zend_try {
 				SG(sapi_headers).http_response_code = 400;
 				PUTS("<b>Security Alert!</b> The PHP CGI cannot be accessed directly.\n\n\

php-7.3.33.tar.xz/sapi/cgi/tests/ghsa-3qgc-jrrr-25jv.phpt Added

php-7.3.33.tar.xz/sapi/cli/php_cli_server.c Changed

php-7.3.33.tar.xz/sapi/cli/tests/ghsa-4w77-75f9-2c8w.phpt Added

php-7.3.33.tar.xz/sapi/fpm/fpm/fpm_status.c Changed

@@ -483,8 +483,8 @@
 		if (full_syntax) {
 			unsigned int i;
 			int first;
-			zend_string *tmp_query_string;
-			char *query_string;
+			zend_string *tmp_query_string, *tmp_request_uri_string;
+			char *query_string, *request_uri_string;
 			struct timeval duration, now;
 #ifdef HAVE_FPM_LQ
 			float cpu;
@@ -511,13 +511,30 @@
 					}
 				}
 
+				request_uri_string = NULL;
+				tmp_request_uri_string = NULL;
+				if (proc.request_uri0 != '\0') {
+					if (encode) {
+						tmp_request_uri_string = php_escape_html_entities_ex(
+								(unsigned char*)proc.request_uri,
+								strlen(proc.request_uri), 1, ENT_DISALLOWED | ENT_HTML_DOC_XML1 | ENT_COMPAT,
+								NULL, /* double_encode */ 1);
+						request_uri_string = ZSTR_VAL(tmp_request_uri_string);
+					} else {
+						request_uri_string = proc.request_uri;
+					}
+				}
+
 				query_string = NULL;
 				tmp_query_string = NULL;
 				if (proc.query_string0 != '\0') {
 					if (!encode) {
 						query_string = proc.query_string;
 					} else {
-						tmp_query_string = php_escape_html_entities_ex((unsigned char *)proc.query_string, strlen(proc.query_string), 1, ENT_HTML_IGNORE_ERRORS & ENT_COMPAT, NULL, 1);
+						tmp_query_string = php_escape_html_entities_ex(
+								(unsigned char*)proc.query_string,
+								strlen(proc.query_string), 1, ENT_DISALLOWED | ENT_HTML_DOC_XML1 | ENT_COMPAT,
+								NULL, /* double_encode */ 1);
 						query_string = ZSTR_VAL(tmp_query_string);
 					}
 				}
@@ -545,7 +562,7 @@
 					proc.requests,
 					duration.tv_sec * 1000000UL + duration.tv_usec,
 					proc.request_method0 != '\0' ? proc.request_method : "-",
-					proc.request_uri0 != '\0' ? proc.request_uri : "-",
+					request_uri_string ? request_uri_string : "-",
 					query_string ? "?" : "",
 					query_string ? query_string : "",
 					proc.content_length,
@@ -558,6 +575,9 @@
 				PUTS(buffer);
 				efree(buffer);
 
+				if (tmp_request_uri_string) {
+					zend_string_free(tmp_request_uri_string);
+				}
 				if (tmp_query_string) {
 					zend_string_free(tmp_query_string);
 				}

php-7.3.33.tar.xz/sapi/fpm/tests/ghsa-7qg2-v9fj-4mwv-status-xss.phpt Added

php-7.3.33.tar.xz/sapi/fpm/tests/tester.inc Changed

@@ -489,7 +489,7 @@
     }
 
     /**
-     * Execute request.
+     * Get request params array.
      *
      * @param string $query
      * @param array $headers
@@ -498,20 +498,13 @@
      * @param string|null $successMessage
      * @param string|null $errorMessage
      * @param bool $connKeepAlive
-     * @return Response
+     * @return array
      */
-    public function request(
+    private function getRequestParams(
         string $query = '',
         array $headers = ,
-        string $uri = null,
-        string $address = null,
-        string $successMessage = null,
-        string $errorMessage = null,
-        bool $connKeepAlive = false
+        string $uri = null
     ) {
-        if ($this->hasError()) {
-            return new Response(null, true);
-        }
         if (is_null($uri)) {
             $uri = $this->makeSourceFile();
         }
@@ -538,6 +531,42 @@
             ,
             $headers
         );
+
+        return array_filter($params, function($value) {
+            return !is_null($value);
+        });
+    }
+
+    /**
+     * Execute request.
+     *
+     * @param string $query
+     * @param array $headers
+     * @param string|null $uri
+     * @param string|null $address
+     * @param string|null $successMessage
+     * @param string|null $errorMessage
+     * @param bool $connKeepAlive
+     * @return Response
+     */
+    public function request(
+        string $query = '',
+        array $headers = ,
+        string $uri = null,
+        string $address = null,
+        string $successMessage = null,
+        string $errorMessage = null,
+        bool $connKeepAlive = false
+    ) {
+        if ($this->hasError()) {
+            return new Response(null, true);
+        }
+        if (is_null($uri)) {
+            $uri = $this->makeSourceFile();
+        }
+
+        $params = $this->getRequestParams($query, $headers, $uri);
+
         try {
             $this->response = new Response(
                 $this->getClient($address, $connKeepAlive)->request_data($params, false)
@@ -558,6 +587,66 @@
     }
 
     /**
+     * Execute multiple requests in parallel.
+     *
+     * @param array|int $requests
+     * @param string|null $address
+     * @param string|null $successMessage
+     * @param string|null $errorMessage
+     * @param bool $connKeepAlive
+     * @return Response
+     * @throws \Exception
+     */
+    public function multiRequest(
+        $requests,
+        string $address = null,
+        string $successMessage = null,
+        string $errorMessage = null,
+        bool $connKeepAlive = false
+    ) {
+        if ($this->hasError()) {
+            return new Response(null, true);
+        }
+
+        if (is_numeric($requests)) {
+            $requests = array_fill(0, $requests, );
+        } elseif (!is_array($requests)) {
+            throw new \Exception('Requests can be either numeric or array');
+        }
+
+        try {
+            $connections = array_map(function ($requestData) use ($address, $connKeepAlive) {
+                $client = $this->getClient($address, $connKeepAlive);
+                $params = $this->getRequestParams(
+                    $requestData'query' ?? '',
+                    $requestData'headers' ?? ,
+                    $requestData'uri' ?? null
+                );
+                return 
+                    'client' => $client,
+                    'requestId' => $client->async_request($params, false),
+                ;
+            }, $requests);
+
+            $responses = array_map(function ($conn) {
+                $response = new Response($conn'client'->wait_for_response_data($conn'requestId'));
+                if ($this->debug) {
+                    $response->debugOutput();
+                }
+                return $response;
+            }, $connections);
+            $this->message($successMessage);
+            return $responses;
+        } catch (\Exception $exception) {
+            if ($errorMessage === null) {
+                $this->error("Request failed", $exception);
+            } else {
+                $this->message($errorMessage);
+            }
+        }
+    }
+
+    /**
      * Get client.
      *
      * @param string $address

php-7.3.33.tar.xz/tests/basic/GHSA-9pqp-7h25-4f32.inc Added

php-7.3.33.tar.xz/tests/basic/GHSA-9pqp-7h25-4f32.phpt Added

@@ -0,0 +1,104 @@
+--TEST--
+GHSA-9pqp-7h25-4f32
+--SKIPIF--
+<?php
+if (!getenv('TEST_PHP_CGI_EXECUTABLE')) {
+    die("skip php-cgi not available");
+}
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die("skip not for Windows in CI - probably resource issue");
+}
+?>
+--FILE--
+<?php
+
+const FILLUNIT = 5 * 1024;
+
+function test($boundaryLen) {
+    printf("Boundary len: %d\n", $boundaryLen);
+
+    $cmd = 
+        getenv('TEST_PHP_CGI_EXECUTABLE'),
+        '-C',
+        '-n',
+        '-dlog_errors=1',
+        __DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
+    ;
+    $cmd = implode(' ', $cmd);
+
+    $boundary = str_repeat('A', $boundaryLen);
+    $body = ""
+        . "--$boundary\r\n"
+        . "Content-Disposition: form-data; name=\"koko\"\r\n"
+        . "\r\n"
+        . "BBB\r\n--" . substr($boundary, 0, -1) . "CCC\r\n"
+        . "--$boundary--\r\n"
+        ;
+
+    $env = array_merge($_ENV, 
+        'REDIRECT_STATUS' => '1',
+        'CONTENT_TYPE' => "multipart/form-data; boundary=$boundary",
+        'CONTENT_LENGTH' => strlen($body),
+        'REQUEST_METHOD' => 'POST',
+        'SCRIPT_FILENAME' => __DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
+    );
+
+    $spec = 
+        0 => 'pipe', 'r',
+        1 => STDOUT,
+        2 => STDOUT,
+    ;
+
+    $pipes = ;
+
+    print "Starting...\n";
+
+    $handle = proc_open($cmd, $spec, $pipes, getcwd(), $env);
+
+    fwrite($pipes0, $body);
+
+    $status = proc_close($handle);
+
+    print "\n";
+}
+
+for ($offset = -1; $offset <= 1; $offset++) {
+    test(FILLUNIT - strlen("\r\n--") + $offset);
+}
+
+?>
+--EXPECTF--
+Boundary len: 5115
+Starting...
+X-Powered-By: %s
+Content-type: text/html; charset=UTF-8
+
+Hello world
+array(1) {
+  "koko"=>
+  string(5124) "BBB
+--AAA%sCCC"
+}
+
+Boundary len: 5116
+Starting...
+X-Powered-By: %s
+Content-type: text/html; charset=UTF-8
+
+Hello world
+array(1) {
+  "koko"=>
+  string(5125) "BBB
+--AAA%sCCC"
+}
+
+Boundary len: 5117
+Starting...
+PHP Warning:  Boundary too large in multipart/form-data POST data in Unknown on line 0
+X-Powered-By: %s
+Content-type: text/html; charset=UTF-8
+
+Hello world
+array(0) {
+}
+

php7.keyring Deleted

@@ -1,707 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBFsXB0IBEACa2MgvyiiM6Zc5CrbnOowqVE9izKLxb1B6fjnQjDfitUoL3gYc
-bB4CtdH8fSotVL6Nlo4VAMNa3kJP4NOsIrrCVtG2dluaykClDyR9iSxCXFXSQFXa
-trxk3bFTZL4mvDtF18zdLRm9o7so19Rz11CeY0QbIj66aXiuvjRIs0Jo+FmAResH
-7BGpSXUPIO50keKfbB3aLSPuroOocUrXIyv8MBS0aqWMGUCw20SVVTAwFyFS5poP
-Aj+FWqyLBfjxL/YqAhGk9sspxVWEoZm1Nl5lCUpWrV2h4Ut/wuiJCrTlmXVNmdmI
-NDsgFLLIpF2A1fGzTnZUqvtIM/scJoJShmMDMbNUvgrUp0sG7sJi7zdlTEVgwjeA
-i2EXs5pDVtN1Njl0cazBOqpZPNlTXC46SZ3NQFVgRf1ouCvrBt9nvrqE2u72Q+Ke
-WJn4DEcHt7GuigjYG7n4p+YnSLbRwf2TmXciDL8TKhAZI4AjhwKywxSzHjHt+uLg
-be3NjCwjx+vr+fOEXazs/mJfALyoN/os1+pcFxNlawv+n5F5Vu2dPoBEvGJjXfvr
-IuSTowxqkISeof6/bmVRi2JNS6YBMYB8RoRtVlyEiKxgXdJKhXZB2ACIE2fdvYK3
-b+LRac+Pq0gcUwZcHTwirHpZF929EuYUqgBrMhS/1E/pe4eb5S70yXuluQARAQAB
-tCFDaHJpc3RvcGggTS4gQmVja2VyIDxjbWJAcGhwLm5ldD6IXgQQEQgABgUCWxrA
-9wAKCRAveVa8XaBLXX51AP0Qhn6p3ZbPKCh5FGErDMEqzzFy0oZRqdkc+BTAPfvP
-5wD/V8qv5VCiF67Eco8CmTiqRFnQmAM6zApILlwelkSqkP6JATMEEAEKAB0WIQQa
-Totyd8QuU9upx7m8qjDqnA1XYwUCWxd2/gAKCRC8qjDqnA1XY4yTCADED5n6vCnq
-eNJtjsp7Pee/pirz8gr1ZG/Ex7DfqllQWqrz03TqHbBLFNG6T/tANmtYNwoJPLtd
-onlZpb/6AhXuRXXoXNXjpTP3RHkSP3Wc+ZIEEfhofGLX4K8D0I7uym+F1zccikqY
-I29TdTtN8KA2mKwSpx3Ng01et0YStDQppOJEEy0SbK2oRTTMM+RWhYgbA+NQtppB
-T/sgaJDEhOzAy5Lof7yp5o0XU48eP0X/sXnE+3g06R0pul4xullwnLUs1s6i8oWq
-Cje6ReLH40v0vWcpdNTZq8TyiOVWE8muqCj/SVArdT1pUYQXVVD+Y05MePtzu5nh
-pyE2oEwGvYsjiQIcBBABCAAGBQJbGqYWAAoJENvbOXRw0SFylugQAJmZLpTJOV4i
-YMN1YtadWbTpfGwdpz0cMAljHylBNUvdyYO6887vjhPhEd3bshr0U28CqQrtpZDk
-TfcuuSfuPqjAE28sRKrG+K+VKmXIP3pkIKeavrWpPqPxE3dEOun1eVysItphuq65
-IdNnOb1XB87eBJw0muB/S0AffUY8pEqetOpDSrrTZ5FjpPzxL7jvF39TWIwCLFG9
-tVPqGzVpWiUNflkv+rGsC3z+q8g0iiU0SOU+US4iAWiPLoI9C1GAGOZEVScYZLrb
-9DdHKysU0GEK9C6fNpO6UvTuvAx9RL9BrGKI9oxmeVstFEy17G7j8u+MvDzF0UVt
-OaB7anQhPdbS1lrUkJXwNQAZ4oqcDGeZ+QDXOTIg2BXLGOs4SLAzubb50PelXUOx
-waHxVk5OBr5soenMs9NL/E8pm43S9I76X7XGHu59QQKrrm3Z0HYMsRjRwCcJUG5d
-/sBmlhtOk+CLCOxTjAFik3Z6hW9IRJMaKN7sQu2S2nWaii2a2PB0UXL/EK0dkk2P
-XyuN85VY5QnF9YQTnuZ3waB3sNduHjXmmFcDLkUgt2htcRiMIHxfRhpkLNO2frQT
-GFnrrD+OtRrTXARjPJ+PuiF9ZFq8bFOI6vkVajbkCBzfYjbZVIx+imBmdCzRcLZ8
-+IP2bRYSiYsuqdBJkqWHaSsVQxiC2yeBiQJUBBMBCAA+FiEEy69p8XOg/qS1N/Rw
-1myVkxGLzLYFAlsXB0ICGwMFCQeEzgAFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AA
-CgkQ1myVkxGLzLajgw//Xi9d4s0I022eGluSdFRVes5FwpmwNPJMcvHgEm9p70Ow
-HQaXMYjjGWRYVdFb2jX/fEb+wemDWFDajmoAo83wgAkFGb479xvJjFfkmjDLWX6+
-Km33dlL2H4vacRaT6EFPqGd/be7mmjkko8IRaACpnEKcWK8/n9JM0P0Jnl9eVMxc
-ZhGZ6Ej+4ZDWTypcwtUIbvmYzEhu1dWeXQ0iir+adPyQ1azbLXsQqtuFfq0pV07O
-xAhJnUI3T5Il5it8KO+VWcIVBL/Abc5+Z+xcgy1dHTawt9+FqLniMgz8Od1oauw3
-FrIapJwxUyeGRTxOTUz3Z/CmHcloyVPuaKT5+d1aRBm0oC672PsI2YWF3X1Qo9vH
-4WksgRxxjKfSOHRGeBzwmzdmEgCNoI2lKMlMi5Zw3BF2SzSEdK6+wrfYL5ilqQXU
-bs5ZYVJLL+ntUZc1HpH+xmCfugLSp33ngEbJoyHGYzt97OFwVgJI0bkP6MbZGLkq
-1wUly7Di0pcPFPXCDSmaTS0sf5k0/DfTtZ3OuOqnPlOtjMtOLJzFuX66jhu0p7vj
-auW5JdVqrHltWnHqjWLjaUZ68KOr+fqgFszvyfyBNzi8+t0+NFg42+JOmU2KkuiX
-juGs8bbJqSh7Q+pgoUubsLMdsvrhrdkIr0r9da2Hw5QlsNQZZEedVnm2nFCphHa5
-Ag0EWxcHQgEQAMNbPSMrGHLsBE/wrfy8HBqMkZNvCK7KJQ2b9KEJaGa78mAQJCgo
-lruB38OnNmCOQD/t9MUasX/8AfwIraRf/1MOeQuyOxPRaWbrow60zLPgdiROMkcc
-WpBSDKhWFTbEUCnaydWBkt1XvJKjP763e32VK7x9RTOp1/Tu59f4DgdfOAjr/YD7
-HO9u+RZj+PXxcTYwTXfGIFeK11kapUssPTaL85ppAdiLU8RqV8uda0wE+7mhB37Z
-VO3ptiwQ4+MI5h9dfDtRO8a05c4cTnC3SZkHbzIG/yhmOw2lrfoUdb3Q77woYGav
-PlflzQy6KUCet8Z0VpTVydIV4bIQZ1+wbYXPA8v298hVfXh/3YnNyml/CU6Ob+/M
-42M4Tb8ZsA5oIb2mk/fvJ8aaxJ+0u7gykGypKQoH9CUadzA/23DD6zB7XsNYwqa2
-boLS5Jvd1tNv9A13NYQTPllgBTgCrxjVJzxBGWpKBEuYGy999fi9CyDvSvSSGncC
-uL+1wECRaeeSQ6DXE8HT8MYSE7MQgKGMia0uCEiRhd5VYlx9xHh8+sRyzftXw9HR
-ZYqziA0QrLucF6VwHgR8+MRcRiOIBcLPMXkJqhji6hvlFe286nbRe/r62E8oUCG4
-N09cvE4Ytgnn+6GTuUSUSFNpDs+rFGwJxYO1/g5kSE6XVqDYbdMRfH/xABEBAAGJ
-AjwEGAEIACYWIQTLr2nxc6D+pLU39HDWbJWTEYvMtgUCWxcHQgIbDAUJB4TOAAAK
-CRDWbJWTEYvMtnAHD/46yHW8IAeIVRqRDZU9fMd7XBhtk8ts37xqzw7+kX9ToPPA
-7hApTGPBsysgWza3Q65yV0WAlSM0fFCYpJ16rjH402Fxl6ChtjwIgR2xaxeV7iNm
-6SoM/7zfFsfTPoBZkjca5G80JWDco3hFEgUI6YGR1+aIYxdmrS1CAVZgVn6jdHsU
-+3R5nVWbfhOIbnNFzJl9apZm2ajD3I9gJxXRd9vsfzkfd/cznG16v0tfFt/Rdd0+
-eVbBnDuK42AyOC2NRtaKJ0T8pFULERQbMBHDuRXXYRgRIDXfPU9gVjmfZ69pfDSM
-KQMkq0En/YeOQvuu40OQo61H/X/wPpv/K4odlBeYucnfv3XI602cfTriUAsN7Jla
-ituVJPJuUFmYKzDYsqrQ7JcTM+RjorA9YjShc5zY5KNxhMQhpcw5gAK5tDUB5KiX
-1xBTvOsiwJGgM3qEjoQ1JWy6S3wFNG4icfEUjCuax3TREywR21GN+ea++ksHhh5b
-togKiMRDhL1F5zkeFuNtLstw0ZUGODCHkS4DSpBa2N3xw6LdIeUq72nu+BNqLC6F
-ofeSbo227LjFRK64MDv9YcrFY5pHYlNlD5B9RQf4kB8z9BRgruUkAfu/gNoKtoQU
-k0M7aoD8coKxy4W8wVcpnJ/ciXfeiZ8FXuXdQa8RZcXHwwxvxgRqlQfDLLn5ow==
-=PZs3
------END PGP PUBLIC KEY BLOCK-----
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQMuBE9mqaARCACFSqcGmNunkjQQu3X+yXnTmFeEkvM4JXZTOBdR8aEevNGmmFEf
-yvjaDjWi9hcwp4E/lYtC+P7VsVjM1OSX9eq0jC/lGL0ZyRXek+mNy0n5H1NSuTpf
-9Y18LMqhc4G+RU+LcNiZ9K0DJuOOvNLPxW7OHZguxb3wdKPXNVa2jyRfJAKm2uaJ
-JMT1mTmFT9a0Q8SKr+mUrrJkuG0H2o6SzrKt8Wwoint1eh67zVsJaJtQFchnEZnl
-awIcqP2yC4nLGR3MkubowxoEBYCZet18aHVVRbvpG2Qtob8Lu5xrsGbmXymTkHTd
-pvkfcJFADa8MzOL90zOxXwbGfbIZOlh5En8jAQCXlfnx2eQL3BSW/6XANa51dbWi
-Ep1d1BAkpGKtZvlk0Qf+M9WAi+9aXMe3xP5krxtgnRNUf2WN6Zdy2MxL1RRJCFby
-tLhl0ronC49BsGYVGshdEH8xhBbiIOJKuVZ/DTl9bEm7P9c7CC7iJyVCkhUAhouH
-6xzZQNLR+RU+QebYzXypVfl99Qk7EdMmr/WAZCHLuvanyqepC5EBsa3VnAfQemSN
-oBeGBKWWLiOsPjvS72+y1z4RUMAfXHn4l/sFMt8zt7/74AmJPwZquV41p4mPO12V
-4+xPyc6RsB84sfsk2QVivU8w8AkvGQeYjXoz7Iwao95+fWteVzZ36KRQvUckP8pG
-jHlDXnHxJ0HI1I/kOBZSjwRwUf0dd73y6erPhbLk+gf+NdI3H9KGJBzG5/rVyWKw
-UeQ9d5ud4jTJRkQGvAP5pg76vEa9dogbpe4W5Z+0BfbiJSnQmQWSHiZddj/t33pt
-bup44Ck6ZTgdlmFYMLF1hR47PIZTDKEREuKYGci/vq8snZvEJP9YCw/TtiHcMdrM
-KcY/+Lp8lQO0GHLPB9glVhnC0db6l1Xpg1CMI8/RozBMcij30EgATggC/y2zbiqA
-FoS9FN9nXPbe4phStqABEyeZ+nXudt7PUYTjVgcrqo8bHZCisBobWC7OnKyUzxVx
-zUeuPkIfmZuzkLaMw2McQdvwwsNvQ0DzaLP30c1Xsm/7EIYJcOWpzlVJ5QrdmE0/
-BbQrU3RhbmlzbGF2IE1hbHlzaGV2IChQSFAga2V5KSA8c3Rhc0BwaHAubmV0PohG
-BBARAgAGBQJPZqpoAAoJEAreXKKG8z3TGOQAoIQ4cbiafbINDLgGSBcLtSyjitO3
-AJ9je8qb1PeFB3ZVOKZ3ogDfZvieRYheBBARCAAGBQJWlwm5AAoJEO4fZjRi2E8B
-WcgA/R8Sgt1wH1XfoGvxQBOvb9ugpdEfGGTUxK03G06svwUBAP9jklRFF2iw1tWa
-wD3S7cYF/Fe7M8pdviBoaD2IwVwhPoh6BBMRCAAiBQJPZqmgAhsDBgsJCAcDAgYV
-CAIJCgsEFgIDAQIeAQIXgAAKCRAveVa8XaBLXYXbAP9akG+UWW4ej5SFXhwhRQt3
-zL8uesCdSgtJJ4aYcmXXBgD/W0BYVhm8cpRZ+8Zp2ydm6WvtGH80VsG4JniEqGSL
-UNWJARwEEAECAAYFAlHmjjoACgkQfexOafycg9fjDAgAwItyQFF7gBPtiZdKnpc7
-yN6bAayv30H9wwgh+TN5hitdWBV1vdnsIlMzQSVB90RPy5a/oIw4bUea2YDyN63c
-5g2xzmAKjF6J2BWeumYLz/QYY3FugJcSzEK90goUoO61ngajKfrqJt4r/q+RM40f
-b3NQm1cChetGn4mT18lzZ2G9dpQUPNjrER5Y9WYlNIuitd3XeNirupnIr9qJpUCU
-VZcslkhR5zCnFc9lHaH44mVmCNXKXWXbWI/MgcoIqMGqbrTapTnkHbgH6qKkVnjB
-x6mdAHDT/0ofNH7u7xL0tUoEBsqPcon5UWnEsMu/Gbb18dH7+k6opcd5hgaWbpvG
-YIkCHAQQAQIABgUCT2rfvQAKCRDBPHC4cme1LY8ZEAC93LY1SsorKcBSato341FP
-je/kEsBbn3q5yjQrxXpz7LRbhLEO90UTGm2QOZBl1E85Zn7CIotbRhvGXI+hCs+i
-g30WToA84SMCOmnqlCnnczy9dOCqYOI2S8ji1H3RVbZDdQ9JFw9zaQ0XcTq70/wi
-ipWvri8awp4DzaT5sZMJjWp34OZ1Phsu16JCpOq7P0PGMdWCCUh6cJEM0wBCnswG
-Sj1m14Z1RAF+QklRz08AZO3vnWrrykKADwrQt3inUVQWKf2LBVNMYTvPnGWuC05/
-5++oyloVzdFZ6y6Q+ceARrQqEAkwoNr5bFZNjeSIpVGuoYPRAzENYGKKaMxVW+mw
-fVvMQ5hnIdDogqWXIRKwV7c+Lkh5w4odYAVcL9lgb8jsceAJTwgltiI/D6HeKX3A
-2YzcJnvW3zwIyXHJM8ap8jNwkR9rwab+h1vjjnaStwIKW0hkCXPNUcd9Y6FyX4eh
-OarDpL1xeOwJ4+TTcbTV49+zl6O7o0X/CkzV4MD9Yorv5gnAmV/Tbxxuh6exij9V
-7nG/yZllmqIr+gZyhOk8rpUEmrjrNFOYU3cfHqETbQcWn60T1nzHsvVwb/5fbkMg
-CbVBr77wYo7w2o5R6O9nIiBO6R/o/Nyhj5Ry3WcA1n6F7R0NQjtpSywVp3+hodz+
-H7Dl8Xgi3eIWtn9Y4TYxN4kCHAQQAQIABgUCVpAePwAKCRC8Y0Io4xNWe80fEAC6
-bW5aZSOGfBbVuHU7TITLJkIaNTnTTDQ5yTNucDA6rNN9I1i/ZqPdkrPx74prCNiH
-s47EU0/I4OOinRWuoduI2cGACyYSELIl7M0IC5O5CwnUTmZ06CDgNpPhwv7W8n1F
-3OK6I+lGeuyWXzDRMJ4xX7duX7gUbTRhxA5iQurVLrClyDqGCJI/AeJOkMNBI6Io
-K+Rrk1+RdqnJusAg55YaF+BbhFynD1wuCg5ZcVSwFgRNnZm2vXgYYKQVNrAH5muF
-iucj80s4PB7VupPqYu2sQ4vlI/lNXblytCl2pkG+8nj6R08pNI2YQzhe5IRl/ES6
-Hkrq1FozyFGmYsbqJHhdh71ir7oXNdh69I2r/7Zb88YSWqIULnlVDW/eh9KwOzD+
-DWiPMdX7Dsols+WJoDyXOvivisIuLjGUyEO8l+mpwlwHvUmKeuhRXbpkk4Hy6/8m
-Ob8oQSqAX/60SbdhJDKax1j9iFf18K/qj35r/Te+g3OW3D6S6NmIwuHiuQossUSd
-UnbQIUbmW5nIbcEbXp2LZWlGhCUKR7swWc7tZc+N0s3VeqIxbXkmVLVMavQKpPig
-6By2Ip5neOTLPlQ7hmGXqp86dQ+RWCNtztd5Pj4eCj9JYj+ZwdXFQbh1ItH/xXER
-0XRdnBvyhcIujCd7dG2Bd8rf7433VjrKV8ORe2oyNokCHAQQAQIABgUCVpAe0gAK
-CRB2ZjIjS1bS7K4kD/9KaPySlvD90m+FRqSkYEnwWC28C8+VwhNqc2VlCaWfUum2
-+EBS6YB6fZNbypUGP3wCJEyuMMzOyTR2xZxSGohTw6fcTQn3w8uVj5TYSa0ALOwd
-B8q2H+fRqoyFLtrrt1PWg1cR0DkkLZrvzAbBoMqB5X/OsiCJiiDM57zdZakIGmWv
-NpaZ1tzFLEGnkLs1vGQNqa5z8o3yk4sxWLAtlvmb5ft0VIXHzqodMFDOv0BF6idg
-Xon/p8RDtkFGcr9xecQY/cTsKiJSDH/wJsAOGD1jDEAOtpPOagUM9mfTrygQJ6bX
-YXwIEStoQiMkAJgQTuvDrTAJRDs6zPkXkGm1p1lmhubB7bFulzE/bnUk0DgaOat+
-/5MJmU9wIui3b+tGVGgpQgBQwI04Xc1FPE6ovqOrRcIm5DxzFhfClVQrRw07j1OG
-8k5vylrksw2rEDjUqRp6ruqMywLwVw3h53TRtjA8qRciU6KHzv6zHlaBKmkXWZ7i
-T528eTUyxENQi9EhAtMNrP4LmL30tARZaedkl335usnbVf8qgB+9G4WF4TmXnhfM
-lPnhdFfr0c30GWCBMGc8gZm2M24q0NM2TAAGmUDUGabNnICGl+rzqTia4eOPe24F
-Ig0v4fTbEFt4JpHnife7zNf29V3IcnRYsjdo7wAE4RzokwsBw/5nWiOr9M/BfIkC
-HAQQAQIABgUCVpAe3gAKCRBS/I577bf8ogleEACqZ0NLyZ2UBqSHQIJoUp5kveGL
-VsjKx2XdovEl/2nZxQ+zH2lbz01c68aXdysn5Fk2VimsNgL9jf69z6jMyp5ZEAfD
-7287b35jvZXCdPe4dRUoN6udyWYIAp3slmEQ4TucSEkIqm8YAG+pFqr2ZTDB6BTJ
-QN+mlKoPXl/JZFwx0XNIgihUB7oQuOuQ9GGmLA89Gxna9+eDLbmW9K6qhFsfAOm/
-7ooh3Du1g/+iQELaTdDxc0eEd7RLEBZIVISrQJBGFIDdhZOqWVjZVSf/kaGLy6EP
-U3PRIAhIQY0YbeEKmC71jqXNoO5TFC2ytIK5wgGSBpqleUtnYXE8JijtDbm9UYif
-ihjIBTxnyvVbUw84UR+JXE+Km6Mqah4+/0R7CNqEwCCL89pr7CAIJNEjHnL6nAQ8
-eMi6ehul8D0TVKE9/Huy8DDBxaPm2LHZdu+A9CpWfbGQXtQbh+QI3O0rsQ0DrX5r
-wRPsTYA2GBlpXrqlttrOleTi206ACrwyBPW7S7sOCHoqttPbElCq0MryBKrcM0yR
-ZsNw2Gc1rhF2yhPp9SItV5BRYX7D86x4hpg5RCQSih95zruYaAdKb3VWwYTNhG8O
-iJnzRNdFvsoLIQFAVv+4srS16oPH3Pbeb1L70JWaz16zaZB54BzDa/uanb2sISyU
-ML5KXhnTeSs4IIrusYkCHAQQAQgABgUCVpAdDwAKCRBmoFGssvN17RXjEACT6gcL
-cpU5RpW1Awm7H1tbqozxu/BhAVduQhRSvoW2K9uhcf2FIU6ORX1qeV8jwvdwh/f8
-qJp1R35VjqXdB9O01fOZaUDFYS+Ne5VpFGwvufSHDoYls0vmt7nHS1ig3bN7zb7x
-yDxriwpZlq9a8nlKTTdVvjzeCazLzie5QMZZ9UpPHqzuMVWrNPpyJitSyIZSyqWM
-wK6rdZ93YPG2fhX1Y4NGS9UNuTA0iZWZG2tM8HWn+H743nH3xcSLRqDxBcqsRvgO
-RnANqHdFPz/5RGlNjkBUdPNNJgdVPRKvfsW+NlFKWMX3c3uWopqf/5Z7a7VCaRKm
-NCx7UHl+wlsqlu50dwioysH1aO2An3DMpbIHskDTW+a6qnGraukBzT35MoW33aA5
-U8/s6j/J9sv4x0Sndd5RpnWCgq4vvXX/DQCitrRkrEwsnhD5tmejn2fFLcPI6/xf
-WqSxTugOFgeThc3r4JIXUtaZf4rcvhL4lfWFX71r6wzr/CL+I/cW0jPOKbVhbAVX
-CncOIE+4Yx5eC3P+vmdcrG+rXn224469jnQZLx5FLM3jFYpwdoyD1COHKXC1Y09y
-R7aavxuf3jLNOWIQFzeKwt1W1HpGYflqnI1xJxvFwYbJ9Hb3W9ticPJOz3tjiwci
-bAvJn7iFa21rIaZJk8OzuEDFhDsWrTxwAuk9PYkCHAQQAQgABgUCVpAeRQAKCRDY
-GjyVJnUoEAlFEACkUTgjmg6nH9EAifzzw+MHYMXTQ8rIoFcx9LtrwftdNreCFHkK
-8Zrxn6TL+Ymcvril1r7josnlD8xfxxAyADbOdwsExYni4qKVbX88sf02SUESsFek
-o9WLEAlvwgWU0dQrZuFLOKvHRA+wCj5ux0yeX20tx7WmQqzk2VBCyifxNCWm9bFi
-xtXwCbr8oX22ANbkrPOoIgFW5movZKMWo9XpdzP1EEJpltxz4zv96wiTWk6DwIya
-L7KuLBdByCE0Ip86H/ti8Z9GdqnXkTZq2XN+yncAHNjTI0rjOkJj8RzGRi5/qfdn
-BBjKeMoe6aT9l5ehlLdRKEj8nYQm5ki0PBpaNRPy2T5laE93Isr5VUq12G3e15I6
-oE4fYeWLG1JDRSMECBsy4QNGrzmAfuG92pQvtsB335w2EcT2ILuUvWjfR27Vdczs
-CpOqGmocX2Y6uJjz7H5ji3yYfzVzRfR7xwVw7fBC7QqWECzZJ9tV2u8HrZF7vTTC
-ATS2EgWKuXT1AWSm06Hixwhxf4oypUxVgiu3PQxNABn0xbsiGZYZrrGB1Eta/8Wu
-IGEW3EjSSQ7hUZYZu/wANjUO3Agag9Rb4NsMQIJ5Gjmj6rvFWIPUNX4LlScmHyK9
-HTKvWLHZAq1+d0KfY3u/Gw+u6jKHxW/mAA/vP0OTyx/4hes8CxtVk2iVvYkCHAQQ
-AQgABgUCVpAf7AAKCRD22tKFAY+sAh43EACYV1SlZKtRPX1uqrWbU4czKzjfffrM
-ShIrqBVfT/1P50jSrA+iKxMdBvTTIHiJ3rpW101f0isMKON5MxCcgQz11fPc5x4k
-eGVtuSSaUdwieALIm6J2mgSVRB/3coaf3ZlMPpK1UhIo9sYQeqIYsZQ8dhmyZX0u
-Jj4c1ZYOanBvVFbiCaZ40Etm7Zl2mpSMGFZdFuhin6VYn8SAXOhT6d7oNZn0Hr71
-Y6N6eO+EGQ51J0P9P/7GnDwo48AC3ps5WgP2yaCyGxGGPs4wcU2JJzrda54f6Igl
-GvY8SehQKhK0jnS0g7zyAcdYESR56fwdsW7jHD/bAEkljAsx3IvMVNudlPpekO6z
-IR4vXkzUV54atyuvTy+MoLP7r0KE6+N2AMZrtNbzySiU3s67aDe++7TgXq5Be8VS
-1cZdJ76D93Ya+YHvCx1qGef+qkqCC79KNfyO8/NZTadZGMf2FNXtlyconyXSdx4S
-ejyPScq34X9Eou8n5kKHMc3XtuXL/9XACe2JMxClaLPRoBa5Y7u49TrRcov+1lMv
-mULEmxT8bLBSEeinxIk1XXPx+BUmeCtlf0vT0G44GLxk7q8HE5PoNVNp21jb2iFr
-uaxtCyQCQn9ep9aM2fZkkJqtF94GSCv10+Il1/0IAEXrF6oBp6+F/OBNY5o0uB1K
-0OWn3lLT5j9xd4kCHAQQAQgABgUCVpAgZAAKCRA36bXG9fagZ45QEADaTzSLYlPQ
-obx4UIlM9787NdXrb0dJwomtW47XHClnug/pc56OUOYvwInImwdTq6Gxm9L6zWAG
-IlqlCsLw4pdo0U3cdwR0T1l2yzSpLWAoJZAtsbFc5hkOk6xK6KacoXNS/SJrs1x9
-7lhICkJ6NXJVotiZ+bfyeQ4pKQzigDos7umnC2HTpLl6fLijcoO4aypEilZBRrrf
-qct05W6w0t0wFe7GU9Q+M5KxTa0m2R3DdDb7gJuwb7pVzCuxSR8xXCElJloWZMKh
-cyaVoLy9LFbr79xvR/3A3dAfsonW1SFGQumMgsQ8kt/HbYk2Mm0RKvTnf2XG+HQr
-sgvfrJy+7cmpHAN7gDxWUcTaPuz5WvID9J6uoefwjAwCcvnR4Ol8iAF2K9hI7IdQ
-Jt0BLbuTq/lsjVvUIiOtGVRLZ2zzy0dK2b2fnoS97j3Tigrju7Gv08TN/H43b+fW
-HF2U31jKRqv3kqKeJkTj8XXnpVG8Dng4A0OQSPGmZaK434paAb2yfmxmiVxfyEYo
-xR2n8s4G4emnbriJW0aD5l18871+EGpBTALXKEM/HFT4m/6ZXEXHpXkmODWQT+JT
-OJyLUIH2G0qRuUcvM/239IHjFXeqqd7SqgKpxTzbDtDasAa9zmYvf8n/8lD3mquo
-bFojAFTGT0d6QZxv3LJ7beYuC5BTrHHviIkCHAQQAQgABgUCVpAiGQAKCRCjveaJ
-8mZ8qwaDEACCfYWjfcgKcOKSR6BtWCopCD/ZDUPu8CAdZgZi7LKhBIUfCweZcsrX
-ddP+yfrtssTq/ZUJ6dqwS2bBik6tZF05xFjWXUICrKqgxNejemtK4Q3nuK9iCcka
-4Oi0WEq97HqzNskk5UbfN1Y1ZcrGIC7OBpaU5SzMiXmzO0VlyqXxZdF1mtkRL0pP
-rs16RykrHNIZem1R4hyie/QI7PY54Lzn3XaV0ln4SZKwIqOkGVIJAgrTEjZoxW4f
-zY0NcKl08ZvBjVsqMX9U99W4buV5q19D/YPx0+f1qyZkbjZvDT6dp/f2SiVO+T8/

Changes of Revision 11